Weakness (CWE)
CWE-125: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How to prevent it (2 mitigations)
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
-
Architecture and Design
Use a language that provides appropriate memory abstractions.
Source: MITRE CWE-125
6,254 results · Feed
-
Medium 5.3
FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline
FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFX_MAP…
-
Medium 6.5
Vulnerability in FreeRDP
FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assum…
-
Medium 6.5
FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message
FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the …
-
Medium 5.1
Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string
A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon mem…
-
Medium 5.5
An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attac…
-
Medium 6.5
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond t…
-
High 8.2
IBM QRadar SIEM Out-of-bounds Read
IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.
-
Medium 6.5
Out of bounds read in Offline in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potent…
-
High 8.8
Out of bounds read in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read mem…
-
High 8.8
Out of bounds read in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to read memory …
-
High 8.8
Out of bounds read in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read mem…
-
Medium 5.3
Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication
When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, di…
-
Medium 4.3
Acrobat for Edge | Out-of-bounds Read (CWE-125)
Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in tha…
-
Medium 4.8
Module block-pool create validates two of the four parameter words it reads
The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array. One of the two unproved words i…
-
Medium 6.9
Module Manager object lookup validates one byte of a module's search name
The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the rec…
-
Medium 6.9
Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion
A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for *using* an object, and using …
-
High 8.5
Cortex-A7 module data validation checks only the first address of a caller-supplied range
The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation …
-
High 8.7
Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reach…
-
High 8.7
Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, w…
-
Medium 4.6
Out-of-bounds read when a multi-line text view string ends with a carriage return
`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The over-read can also cause callers to advance their index past the end of the string, …
-
Medium 6.1
JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes…
-
Medium 6.8
JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `…
-
Medium 6.8
GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose ext…
-
High 8.4
PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chun…
-
Medium 4.8
Module queue front-send validates a word count as a byte count
A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's `tx_queue_messag…
-
Medium 5.2
USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count
A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page.
-
Medium 4.9
VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors…
-
Medium 4.9
Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser
A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descriptor onl…
-
Medium 6.9
A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.
-
Medium 4.3
QBinaryJson::fromBinaryData() integer overflow leading to OOB read
A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.
-
Medium 4.3
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS G…
-
Medium 6.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS…
-
Low 3.3
An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciou…
-
Critical 9.1
Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the de…
-
Medium 5.5
A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box b…
-
High 8.8
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap t…
-
High 8.8
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretati…
-
High 7.1
Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.
-
Low 3.1
IBM MQ Out-of-bounds Read
IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected.
-
Low 3.3
libaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGR
libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC…