Weakness (CWE)
CWE-125: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How to prevent it (2 mitigations)
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
-
Architecture and Design
Use a language that provides appropriate memory abstractions.
Source: MITRE CWE-125
2,828 results · Clear filters · Feed
-
Medium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An ap…
-
Medium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
Medium 4.3
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS G…
-
Medium 6.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
Medium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS…
-
Medium 6.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
Medium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS…
-
Medium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An ap…
-
Medium 6.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
Medium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
Medium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An ap…
-
Medium 6.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and i…
-
Medium 5.5
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2…
-
Medium 6.8
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS…
-
Medium 6.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
Medium 6.1
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
Medium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS…
-
Medium 5.2
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
Medium 6.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
Medium 6.3
Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser…
-
Medium 6.3
FastStone Image Viewer Box-Average Downsampler FUN_0062d96c out-of-bounds
A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor…
-
Medium 6.2
ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernel_shape attribute by deriving an em…
-
Medium 6.2
ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInference_opset1_to_6() processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verify…
-
Medium 6.5
Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data Retransmission
-
Medium 4.6CVE-2026-116487 Public exploit
NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for O…
-
Medium 6.5
Out-of-Bounds Read via Unchecked Length Values
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating th…
-
Medium 6.5
libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This all…
-
Medium 6.5
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_d…
-
Medium 5.3
Kakao khaiii JSON Config File Linear.cpp open out-of-bounds
A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hidden_dim/c…
-
Medium 6.3
Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byt…
-
Medium 5.2
Out-of-bounds Read in ntpsec
Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control (@@Gc) reply with an out-of-range mode byte.
-
Medium 4.3
Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or…
-
Medium 6.2
Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multip…
-
Medium 5.3
FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline
FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFX_MAP…
-
Medium 6.5
Vulnerability in FreeRDP
FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assum…
-
Medium 6.5
FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message
FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the …
-
Medium 5.1
Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string
A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon mem…
-
Medium 5.5
An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attac…
-
Medium 6.5
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond t…
-
Medium 6.5
Out of bounds read in Offline in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potent…