Weakness (CWE)
CWE-125: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How to prevent it (2 mitigations)
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
-
Architecture and Design
Use a language that provides appropriate memory abstractions.
Source: MITRE CWE-125
6,255 results · Feed
-
High 7.5
The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `Came…
-
Medium 4.0
In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to …
-
Medium 5.3
In decode_packed_entry_number of codebook.c, there is a possible out-of-bounds read due to a logic error in the code. T…
-
Medium 4.0
In validateImageInfo of Bitmap.cpp, there is a possible out-of-bounds read due to a precondition check failure. This co…
-
Medium 5.3
In process of C2SoftApvDec.cpp, there is a possible out-of-bounds read due to a logic error in the code. This could lea…
-
High 8.4
In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead t…
-
Medium 5.9
psqlODBC does not validate server-supplied counts and lengths
psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixe…
-
Low 3.3
The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header
The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs att…
-
Medium 6.1
Netpbm before 10.86.51, 11.02.30, and 11.15.08 Out-of-Bounds Read via tgatoppm
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-m…
-
Critical 9.1
Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds o…
-
Medium 5.3
In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial …
-
Medium 5.3
In Modem, there is a possible out of bounds read due to an integer overflow. This could lead to remote denial of servic…
-
Medium 5.3
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of ser…
-
Medium 5.3
In Modem, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of …
-
Medium 5.3
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of ser…
-
Medium 5.3
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of se…
-
Medium 5.3
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 5.3
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of ser…
-
High 7.5
imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash
### Summary Out-of-bounds heap write in imgproxy's ICO loader (`vips/icoload.c`): when the ICO entry's image data buffer is small, the loader's BMP-header-reconstruction writes land past the allocation, corrupting the size field of the following heap chunk. T…
-
High 7.9CVE-2026-62958 Public exploit
libriscv: Out of bounds read vuln in the ELF parser (Denial of service)
libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-hea…
-
Medium 6.9
Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages
Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an…
-
Medium 5.9
gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments
gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParame…
-
High 7.8
Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so f…
-
Medium 6.1
Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via blo_bhead_id Accessors
Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks that, when brow…
-
Medium 5.5
Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via GLOB Block
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, w…
-
Medium 6.1
Scribus before 1.6.7 and 1.7.x before 1.7.4 Out-of-Bounds Read via PICT Planar Image Data
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or …
-
High 7.3
libass: Out-of-bounds read and write in wrap_lines_measure
libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap…
-
Low 3.7
Gcc: out-of-bounds read in std::from_chars
A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, poten…
-
Low 3.6
Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk
A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a m…
-
Low 3.3
Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading
A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of…
-
Medium 5.9
MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used ser…
-
High 8.2
A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A…
-
Critical 9.2
Botan: Integer overflow when reporting block size in FFI can cause memory corruption
Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the …
-
High 7.5
Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
-
Medium 5.3
Out-of-bounds read of DCP block header in DCP Set and Identify request parsing
P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the block length of the following block is …
-
High 7.1
Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()
P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic,…
-
High 7.1
Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()
P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN …
-
Medium 4.3
Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigg…
-
Medium 5.3
lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()
lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send frag…
-
High 7.5
Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read
A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C…