Weakness (CWE)
CWE-125: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How to prevent it (2 mitigations)
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
-
Architecture and Design
Use a language that provides appropriate memory abstractions.
Source: MITRE CWE-125
6,255 results · Feed
-
Low 3.5
Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable…
-
Low 3.5
Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability
Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. A…
-
Medium 4.3
Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing
An Out-of-Bounds Read vulnerability in the VRRP implementation in Juniper Networks Session Smart Router allows an L2-adjacent attacker to read stale memory contents or cause a system fault via a specially crafted VRRPv3 advertisement.
-
Medium 5.3
Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification
An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to cause a denial of service via a specially crafted HTTP request.
-
High 8.8
Out of bounds read in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised…
-
High 8.8
Out of bounds read in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory inside th…
-
Medium 4.3
ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory API
Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that th…
-
Medium 6.0
Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds w…
-
Low 3.6
Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.
Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.
-
Medium 5.5
Substance3D - Painter | Out-of-bounds Read (CWE-125)
Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction i…
-
High 7.2
Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service
An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization pro…
-
Medium 6.1
SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader
SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplane…
-
Medium 4.3
zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()
zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends …
-
Medium 4.3
Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt
An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buff…
-
Medium 5.3
Out-of-bounds read vulnerability in NTLM authentication handling impacts Qt
Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM ch…
-
Medium 5.5
DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq arch…
-
Medium 5.5
llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info
llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.toke…
-
Medium 6.1
llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets
llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama_model_loader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbi…
-
High 7.3
Tencent RapidJSON Regex stream.h Take out-of-bounds
A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream<UTF8<char>>::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds…
-
Medium 5.3
ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector
ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-c…
-
Medium 6.1
libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array
Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to…
-
Low 3.7
flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number
flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal …
-
Medium 4.4
libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table
libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing …
-
Medium 5.5
Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker …
-
Low 3.3
libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a
libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x001a() caused by an unbounded strlen on embedded XML plist data. Attackers can supply a crafted FileVault 2 volume with non-NUL-terminated plis…
-
Medium 5.5
libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x0024
libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x0024() because xml_plist_data_size is not checked against the source metadata block. Attackers can supply a crafted FileVault 2 Core Storage vo…
-
Low 3.3
gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c
gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buf…
-
Low 3.3
gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title
Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buff…
-
Medium 5.5
gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index
gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious…
-
Medium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An ap…
-
High 7.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS…
-
High 7.1
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 2…
-
High 7.1
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS…
-
High 8.8
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, …
-
High 7.1
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS…
-
High 7.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
High 7.1
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS…
-
Medium 6.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and i…
-
High 7.5
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27.2…
-
Medium 6.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and i…