Weakness (CWE)
CWE-125: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How to prevent it (2 mitigations)
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
-
Architecture and Design
Use a language that provides appropriate memory abstractions.
Source: MITRE CWE-125
6,275 results · Feed
-
High 7.5
Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
-
Medium 6.5
Windows IKE Extension Information Disclosure Vulnerability
Out-of-bounds read in Windows IKE Extension allows an authorized attacker to disclose information over a network.
-
High 7.5
Role: DNS Server Denial of Service Vulnerability
Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.
-
Medium 5.5
Windows iSCSI Information Disclosure Vulnerability
Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information locally.
-
High 7.8
HTTP.sys Remote Code Execution Vulnerability
Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally.
-
Medium 5.5
Microsoft Windows Search Component Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows DNS Denial of Service Vulnerability
Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network.
-
High 7.1
Windows Bluetooth Port Driver Remote Code Execution
Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.
-
Medium 5.5
Microsoft Windows Search Component Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Remote POS Driver Information Disclosure Vulnerability
Out-of-bounds read in Windows Remote POS Driver allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows DNS Remote Code Execution Vulnerability
Out-of-bounds read in Windows DNS allows an authorized attacker to execute code over a network.
-
Medium 4.7
Windows Kernel Information Disclosure Vulnerability
Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally.
-
Medium 4.7
Desktop Window Manager Information Disclosure Vulnerability
Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Overlay Filter Information Disclosure Vulnerability
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to disclose information locally.
-
High 7.8
Windows Overlay Filter Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Overlay Filter Remote Code Execution Vulnerability
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to execute code locally.
-
High 7.8
SQLite Elevation of Privilege Vulnerability
Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Windows AppX Deployment Service Information Disclosure Vulnerability
Out-of-bounds read in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.
-
Medium 5.3
Windows Kernel Denial of Service Vulnerability
Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network.
-
High 8.8
Microsoft Excel Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
Medium 5.5
Microsoft Defender Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Defender allows an authorized attacker to disclose information locally.
-
Medium 6.5
Microsoft Office Access Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose information over a network.
-
High 8.8
Microsoft Office Access Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
-
Medium 6.5
Microsoft Office Word Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Adobe Framemaker | Out-of-bounds Read (CWE-125)
Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in tha…
-
Medium 5.5
Adobe Framemaker | Out-of-bounds Read (CWE-125)
Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in tha…
-
Medium 5.5
Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()
A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the …
-
Medium 6.5
ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths agai…
-
Medium 5.3
FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name
FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATE_R…
-
Medium 4.3
FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via RD Gateway Messages
FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string Actu…
-
Medium 6.5
FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an or…
-
High 7.3
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exp…
-
High 7.3
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exp…
-
Medium 5.3
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic …
-
Medium 5.3
Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds
A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function create_striped_mat_to_gpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipula…
-
Medium 5.3
Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds
A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function gguf_init_from_file of the file ggml.c of the component GGUF Parser. This manipulation of the argument data_offset causes out-of-bou…
-
High 7.5
libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allo…
-
Medium 5.4
IBM i is Affected By A Denial of Service Vulnerability in Host Servers
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.
-
Critical 9.8
OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table
ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproduci…
-
High 7.1
Out-of-bounds read in Progress MarkLogic Server
Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited infor…