Weakness (CWE)
CWE-125: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How to prevent it (2 mitigations)
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
-
Architecture and Design
Use a language that provides appropriate memory abstractions.
Source: MITRE CWE-125
6,278 results · Feed
-
Medium 5.5
NTFS Information Disclosure Vulnerability
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to disclose information locally.
-
High 7.8
NTFS Elevation of Privilege Vulnerability
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
-
High 8.8
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
-
High 8.5
Local Code Execution Vulnerability in Arena®
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can …
-
High 8.5
Local Code Execution Vulnerability in Arena®
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitr…
-
High 8.5
Local Code Execution Vulnerability in Arena®
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can …
-
High 8.5
Local Code Execution Vulnerability in Arena®
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can …
-
Medium 6.3
Nothings stb stbhw_build_tileset_from_image out-of-bounds
A vulnerability was found in Nothings stb up to f056911. It has been declared as critical. Affected by this vulnerability is the function stbhw_build_tileset_from_image. The manipulation of the argument h_count/v_count leads to out-of-bounds read. The attack …
-
Medium 4.3
Nothings stb Header Array stbhw_build_tileset_from_image out-of-bounds
A vulnerability was found in Nothings stb up to f056911. It has been classified as problematic. Affected is the function stbhw_build_tileset_from_image of the component Header Array Handler. The manipulation of the argument w leads to out-of-bounds read. It i…
-
Medium 4.6
Out-of-bounds Read in HashPeImageByType()
EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availa…
-
High 7.8
Out-of-bounds Read in Windows WLAN Host
Memory corruption while IOCTL call is invoked from user-space to read board data.
-
Medium 6.7
In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalat…
-
Medium 6.7
In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalat…
-
Medium 6.7
In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalat…
-
Medium 6.5
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 5.3
In keymaster, there is a possible out of bounds read due to a missing bounds check. This could lead to local informatio…
-
Low 3.3
arkcompiler_ets_runtime has an out-of-bounds read vulnerability
in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.
-
Low 3.3
arkcompiler_ets_runtime has an out-of-bounds read vulnerability
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
-
Low 3.3
arkcompiler_ets_runtime has an out-of-bounds read vulnerability
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
-
Low 3.3
arkcompiler_ets_runtime has an out-of-bounds read vulnerability
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
-
Medium 4.0
Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function i…
-
Low 3.3
Open Asset Import Library Assimp File SceneCombiner.cpp AddNodeHashes out-of-bounds
A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::SceneCombiner::AddNodeHashes of the file code/Common/SceneCombiner.cpp of the component File Handler. The m…
-
Medium 5.5
can: ucan: fix out of bound read in strscpy() source
In the Linux kernel, the following vulnerability has been resolved: can: ucan: fix out of bound read in strscpy() source Commit 7fdaf8966aae ("can: ucan: use strscpy() to instead of strncpy()") unintentionally introduced a one byte out of bound read on strscp…
-
High 7.0
Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content
A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.
-
Low —
PyO3 Risk of buffer overflow in `PyString::from_object`
`PyString::from_object` took `&str` arguments and forwarded them directly to the Python C API without checking for terminating nul bytes. This could lead the Python interpreter to read beyond the end of the `&str` data and potentially leak contents of the out…
-
High 7.1
iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
In the Linux kernel, the following vulnerability has been resolved: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. …
-
High 7.1
vlan: enforce underlying device type
In the Linux kernel, the following vulnerability has been resolved: vlan: enforce underlying device type Currently, VLAN devices can be created on top of non-ethernet devices. Besides the fact that it doesn't make much sense, this also causes a bug which leak…
-
High 7.1
wifi: iwlwifi: limit printed string from FW file
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from FW file There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's …
-
High 7.8
DWFX File Parsing Out-of-Bounds Read Vulnerability
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the c…
-
High 7.8
DWFX File Parsing Out-of-Bounds Read Vulnerability
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the c…
-
Medium 5.0
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS…
-
Medium 5.5
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18…
-
Critical 9.8
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.4, macOS Son…
-
High 7.8
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS S…
-
High 8.8
A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS So…
-
Critical 9.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may b…
-
Critical 9.8
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18…
-
Critical 9.8
The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, ma…
-
Medium 6.3
Open Asset Import Library Assimp ASE File ASELoader.cpp BuildUniqueRepresentation out-of-bounds
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/ASELoader.cpp of the component ASE File Handler. The manipu…
-
High 7.1
wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads This patch fixes slab-out-of-bounds reads in brcmfmac that occur in brcmf_construct_chaninfo() and brcmf_e…