Weakness (CWE)
CWE-126: Buffer Over-read
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
Source: MITRE CWE-126
283 results · Clear filters · Feed
-
Medium 6.5
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
-
Medium 6.9
Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()
Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
-
Medium 5.3
xrdp: Malformed Confirm Active capability sets cause out-of-bounds reads
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validation for specific capab…
-
Medium 6.5
ProFTPD mod_sftp Signed Integer Overflow via SCP Size-Record Parser
ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64_MAX, which res…
-
Medium 5.4
TDengine: Authenticated Out-of-Bounds Read in SQL Lexer tGetToken
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\ and read one byte beyond the null ter…
-
Medium 5.3
Tornado: Out-of-bounds memory access in C extension
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read u…
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Windows Remote Desktop Client Information Disclosure Vulnerability
Buffer over-read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
Medium 4.5
Windows Hyper-V Denial of Service Vulnerability
Buffer over-read in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Buffer over-read in Windows Kernel allows an authorized attacker to disclose information locally.
-
Medium 6.1
Windows Print Spooler Information Disclosure Vulnerability
Buffer over-read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
Buffer over-read in Windows RDP allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Windows NTFS Information Disclosure Vulnerability
Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally.
-
Medium 4.1
A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all …
-
Medium 4.1
A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all …
-
Medium 6.1
An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the …
-
Medium 6.5
Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"
A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cau…
-
Medium 6.5
Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()
A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that…
-
Medium 6.5
Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()
A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byt…
-
Medium 6.9
Global Buffer Overflow in GNU gzip
GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across …
-
Medium 4.8
Out-of-bounds read in SetMacAddrAction
An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash.
-
Medium 4.7
Microsoft Office Information Disclosure Vulnerability
Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information locally.
-
Medium 5.0
389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing
A flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, causing a heap buffer over-read in string filter parsing that may influence internal filter processing behavior.
-
Medium 4.9
OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI's log enricher mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.c…
-
Medium 5.5
Buffer Over-read in WLAN Host Communication
Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
-
Medium 4.3
PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major v…
-
Medium 5.3
Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input
Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input. The auto-detect form of argon2_verify passes encoded_len - 1 as the length argument to memchr without checking that encoded_len …
-
Medium 6.1
Buffer Over-read in DSP Service
Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.
-
Medium 6.5
Buffer Over-read in WLAN Firmware
Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
-
Medium 6.5
Buffer Over-read in WLAN HAL
Transient DOS when processing target power rate tables during channel configuration.
-
Medium 5.5
Buffer Over-read in Wireshark
Kismet protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
-
Medium 6.5
Buffer overread in ns_printrrf with corrupted RDATA field
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allo…
-
Medium 6.1
Windows Kernel Memory Information Disclosure Vulnerability
Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally.
-
Medium 6.5
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
-
Medium 4.8
Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.
Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, from 5.3.0 b…
-
Medium 5.3
Out-of-bounds read when parsing DNS packets via Lua
An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets. The out-of-bounds read might trigger a crash, leading to a denial of service, or access un…
-
Medium 4.0
ImageMagick has a heap Buffer Over-read in its DJVU image format handler
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer tru…
-
Medium 4.0
ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability occurs when processing an image with small dimension using the `-wavelet-denoise` op…
-
Medium 5.5
Buffer Overread in FreeRDP Icon Processing
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a buffer overread in `freerdp_image_copy_from_icon_data()` (libfreerdp/codec/color.c) can be triggered by crafted RDP Window Icon (TS_ICON_INFO) data. The bug is reachab…
-
Medium 5.5
Buffer Over-read in Wireshark
RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service