Weakness (CWE)
CWE-823: Use of Out-of-range Pointer Offset
The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
More detail
The offset might be out-of-range if it comes from an untrusted source, is the result of an incorrect calculation, or occurs because of another error.
If an attacker can control or influence the offset so that it points outside of the intended boundaries of the structure, then the attacker may be able to read or write to memory locations that are used elsewhere in the product. As a result, the attack might change the state of the product as accessed through program variables, cause a crash or instable behavior, and possibly lead to code execution.
Source: MITRE CWE-823
67 results · Clear filters · Feed
-
High 7.8
Windows Audio Service Elevation of Privilege Vulnerability
Use of out-of-range pointer offset in Windows Audio Service allows an authorized attacker to elevate privileges locally.
-
High 8.4
Use of out-of-range pointer offset in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Doma…
-
High 8.8
GPU DDK - OOB write in UntwiddlePOTSquare64bpp
A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileg…
-
High 7.2
Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service
An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization pro…
-
High 7.1CVE-2026-104944 Public exploit
Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500
TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service co…
-
High 8.5
An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing…
-
High 7.7
OpenSlide: Arbitrary memory write with crafted Ventana BIF file
OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts…
-
High 7.8
GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result…
-
High 8.8
Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process
The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of …
-
High 7.1
GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB read and potentially to…
-
High 7.8
GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result…
-
High 7.8
GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex()
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow pri…
-
High 7.7
GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could ena…
-
High 8.1
Memory safety bug fixed in Thunderbird 152
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
-
High 7.8
A heap-based buffer overflow vulnerability exists in the LXF element parsing functionality of MediaInfoLib (version(s):…
-
High 8.1
uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided
uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. Thi…
-
High 7.5
Incorrect boundary conditions in the Audio/Video: Playback component
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
-
High 8.2
lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer
lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library f…
-
High 8.6
UCanCode E-XD++ Visualization Enterprise Suite Untrusted Pointer Dereference RCE
UCanCode E-XD++ Visualization Enterprise Suite contains an untrusted pointer dereference vulnerability via the TKDRAWCAD.TKDrawCADCtrl.1 ActiveX control. This is because it exposes a RotateShape method that dereferences a user-supplied pointer without suffici…
-
High 7.5
Invalid characters cause assert
To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must *N…
-
High 7.8
Use of Out-of-range Pointer Offset in DSP Service
Memory corruption while processing an escape call.
-
High 8.8
Use of Out-of-range Pointer Offset in TZ Firmware
Memory corruption while performing SCM call.
-
High 7.8
GPU DDK - Insufficient validation in RGXCREATEFREELIST creates corrupt freelist
Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driv…
-
High 8.2
GPU DDK - rgxfw_hwperf_get_packet_buffer OOB write
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
-
High 7.8
Use of Out-of-range Pointer Offset in Trust Management Engine
Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation.
-
High 7.8
Use of Out-of-range Pointer Offset in Automotive Audio
Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.
-
High 7.3
GPU DDK - rgxfw_pcset_ungrab OOB write via psFWMemContext->uiPageCatBaseRegSet
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
-
High 7.8
GPU DDK - RGXFWIF_HWPERF_CTL_BLK.uiNumCounters OOB write
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write data outside the Guest's virtualised GPU memory.
-
High 7.8
Use of Out-of-range Pointer Offset in WLAN Windows Host
Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality.
-
High 7.8
Use of Out-of-range Pointer Offset in Display
Memory corruption may occour while generating test pattern due to negative indexing of display ID.
-
High 7.8
GPU DDK - Multiple integer overflow in DmaTransfer PMR_DevPhysAddr functions leading to OOB writes
Software installed and run as a non-privileged user may conduct improper GPU system calls to access OOB kernel memory.
-
High 7.8
GPU DDK - rgxfw_pm_add_freelist_for_reconstruction OOB write
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to subvert reconstruction activities to trigger a write of data outside the Guest's virtualised GPU memory.
-
High 7.1
GPU DDK - OOB read into fwlog due to unchecked block count
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory.
-
High 7.1
GPU DDK - Out of bounds read into fwlog due to unchecked loop bounds
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory.
-
High 8.8
Use of Out-of-range Pointer Offset in Video
On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware which can lead to an invalid memory access by the decoder.
-
High 8.2
Use of Out-of-range Pointer Offset in Mongoose Web Server library
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.
-
High 8.4
Multiple issues in ctl(4) CAM Target Layer
The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel help memory. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vul…
-
High 7.4
Memory corruption in thread creation
In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
-
High 7.8
Use of Out-of-range Pointer Offset in Video
Memory corruption when the payload received from firmware is not as per the expected protocol size.
-
High 7.8
Unixodbc: out of bounds stack write due to pointer-to-integer types conversion
An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken.