CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
11356 vulnerabilities reference this CWE, most recent first.
GHSA-3HQJ-63HV-2G5H
Vulnerability from github – Published: 2026-06-05 00:31 – Updated: 2026-06-05 03:31Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
{
"affected": [],
"aliases": [
"CVE-2026-10889"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-04T23:16:50Z",
"severity": "HIGH"
},
"details": "Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)",
"id": "GHSA-3hqj-63hv-2g5h",
"modified": "2026-06-05T03:31:30Z",
"published": "2026-06-05T00:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10889"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/513003797"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3HQW-57C7-46JW
Vulnerability from github – Published: 2025-03-11 18:32 – Updated: 2025-03-11 18:32Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.
{
"affected": [],
"aliases": [
"CVE-2025-24987"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-11T17:16:34Z",
"severity": "MODERATE"
},
"details": "Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.",
"id": "GHSA-3hqw-57c7-46jw",
"modified": "2025-03-11T18:32:18Z",
"published": "2025-03-11T18:32:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24987"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24987"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3HQX-Q64W-MFRV
Vulnerability from github – Published: 2022-09-17 00:00 – Updated: 2022-09-17 00:00Adobe InCopy version 17.3 (and earlier) and 16.4.2 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2022-38402"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-16T18:15:00Z",
"severity": "HIGH"
},
"details": "Adobe InCopy version 17.3 (and earlier) and 16.4.2 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-3hqx-q64w-mfrv",
"modified": "2022-09-17T00:00:32Z",
"published": "2022-09-17T00:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38402"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/incopy/apsb22-53.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3HRV-H2GX-W5G3
Vulnerability from github – Published: 2026-06-09 18:30 – Updated: 2026-06-09 18:30Windows Kerberos Denial of Service Vulnerability
{
"affected": [],
"aliases": [
"CVE-2026-42914"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-09T17:17:11Z",
"severity": "MODERATE"
},
"details": "Windows Kerberos Denial of Service Vulnerability",
"id": "GHSA-3hrv-h2gx-w5g3",
"modified": "2026-06-09T18:30:44Z",
"published": "2026-06-09T18:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42914"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42914"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3HV8-3V7J-3C69
Vulnerability from github – Published: 2022-05-17 02:14 – Updated: 2022-05-17 02:14A length validation (leading to out-of-bounds read and write) flaw was found in the way eapmd5pass 1.4 handled network traffic in the extract_eapusername function. A remote attacker could potentially use this flaw to crash the eapmd5pass process by generating specially crafted network traffic.
{
"affected": [],
"aliases": [
"CVE-2017-11670"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-31T17:29:00Z",
"severity": "HIGH"
},
"details": "A length validation (leading to out-of-bounds read and write) flaw was found in the way eapmd5pass 1.4 handled network traffic in the extract_eapusername function. A remote attacker could potentially use this flaw to crash the eapmd5pass process by generating specially crafted network traffic.",
"id": "GHSA-3hv8-3v7j-3c69",
"modified": "2022-05-17T02:14:02Z",
"published": "2022-05-17T02:14:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11670"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2017/07/31/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3HVM-3988-FR2X
Vulnerability from github – Published: 2022-05-14 03:37 – Updated: 2022-05-14 03:37An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation is part of the XPS font processing. A successful attack can lead to sensitive data exposure.
{
"affected": [],
"aliases": [
"CVE-2018-4894"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-27T05:29:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation is part of the XPS font processing. A successful attack can lead to sensitive data exposure.",
"id": "GHSA-3hvm-3988-fr2x",
"modified": "2022-05-14T03:37:30Z",
"published": "2022-05-14T03:37:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-4894"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/acrobat/apsb18-02.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102996"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040364"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3HW4-PVHH-9QCQ
Vulnerability from github – Published: 2024-05-21 15:31 – Updated: 2025-03-06 15:34In the Linux kernel, the following vulnerability has been resolved:
coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()
commit 6f755e85c332 ("coresight: Add helper for inserting synchronization packets") removed trailing '\0' from barrier_pkt array and updated the call sites like etb_update_buffer() to have proper checks for barrier_pkt size before read but missed updating tmc_update_etf_buffer() which still reads barrier_pkt past the array size resulting in KASAN out-of-bounds bug. Fix this by adding a check for barrier_pkt size before accessing like it is done in etb_update_buffer().
BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698 Read of size 4 at addr ffffffd05b7d1030 by task perf/2629
Call trace: dump_backtrace+0x0/0x27c show_stack+0x20/0x2c dump_stack+0x11c/0x188 print_address_description+0x3c/0x4a4 __kasan_report+0x140/0x164 kasan_report+0x10/0x18 __asan_report_load4_noabort+0x1c/0x24 tmc_update_etf_buffer+0x4b8/0x698 etm_event_stop+0x248/0x2d8 etm_event_del+0x20/0x2c event_sched_out+0x214/0x6f0 group_sched_out+0xd0/0x270 ctx_sched_out+0x2ec/0x518 __perf_event_task_sched_out+0x4fc/0xe6c __schedule+0x1094/0x16a0 preempt_schedule_irq+0x88/0x170 arm64_preempt_schedule_irq+0xf0/0x18c el1_irq+0xe8/0x180 perf_event_exec+0x4d8/0x56c setup_new_exec+0x204/0x400 load_elf_binary+0x72c/0x18c0 search_binary_handler+0x13c/0x420 load_script+0x500/0x6c4 search_binary_handler+0x13c/0x420 exec_binprm+0x118/0x654 __do_execve_file+0x77c/0xba4 __arm64_compat_sys_execve+0x98/0xac el0_svc_common+0x1f8/0x5e0 el0_svc_compat_handler+0x84/0xb0 el0_svc_compat+0x10/0x50
The buggy address belongs to the variable: barrier_pkt+0x10/0x40
Memory state around the buggy address: ffffffd05b7d0f00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00 ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03 ^ ffffffd05b7d1080: fa fa fa fa 00 02 fa fa fa fa fa fa 03 fa fa fa ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa ==================================================================
{
"affected": [],
"aliases": [
"CVE-2021-47346"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:21Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()\n\ncommit 6f755e85c332 (\"coresight: Add helper for inserting synchronization\npackets\") removed trailing \u0027\\0\u0027 from barrier_pkt array and updated the\ncall sites like etb_update_buffer() to have proper checks for barrier_pkt\nsize before read but missed updating tmc_update_etf_buffer() which still\nreads barrier_pkt past the array size resulting in KASAN out-of-bounds\nbug. Fix this by adding a check for barrier_pkt size before accessing\nlike it is done in etb_update_buffer().\n\n BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698\n Read of size 4 at addr ffffffd05b7d1030 by task perf/2629\n\n Call trace:\n dump_backtrace+0x0/0x27c\n show_stack+0x20/0x2c\n dump_stack+0x11c/0x188\n print_address_description+0x3c/0x4a4\n __kasan_report+0x140/0x164\n kasan_report+0x10/0x18\n __asan_report_load4_noabort+0x1c/0x24\n tmc_update_etf_buffer+0x4b8/0x698\n etm_event_stop+0x248/0x2d8\n etm_event_del+0x20/0x2c\n event_sched_out+0x214/0x6f0\n group_sched_out+0xd0/0x270\n ctx_sched_out+0x2ec/0x518\n __perf_event_task_sched_out+0x4fc/0xe6c\n __schedule+0x1094/0x16a0\n preempt_schedule_irq+0x88/0x170\n arm64_preempt_schedule_irq+0xf0/0x18c\n el1_irq+0xe8/0x180\n perf_event_exec+0x4d8/0x56c\n setup_new_exec+0x204/0x400\n load_elf_binary+0x72c/0x18c0\n search_binary_handler+0x13c/0x420\n load_script+0x500/0x6c4\n search_binary_handler+0x13c/0x420\n exec_binprm+0x118/0x654\n __do_execve_file+0x77c/0xba4\n __arm64_compat_sys_execve+0x98/0xac\n el0_svc_common+0x1f8/0x5e0\n el0_svc_compat_handler+0x84/0xb0\n el0_svc_compat+0x10/0x50\n\n The buggy address belongs to the variable:\n barrier_pkt+0x10/0x40\n\n Memory state around the buggy address:\n ffffffd05b7d0f00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00\n ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n \u003effffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03\n ^\n ffffffd05b7d1080: fa fa fa fa 00 02 fa fa fa fa fa fa 03 fa fa fa\n ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa\n ==================================================================",
"id": "GHSA-3hw4-pvhh-9qcq",
"modified": "2025-03-06T15:34:35Z",
"published": "2024-05-21T15:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47346"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0115687be7b13993066aef602253a53d55f5b11f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/04bd77ef4f4d9fc6102023b85f4590fc2130aac5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/35c1c4bd2d59ad734129d4e232af9d1098023918"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5fae8a946ac2df879caf3f79a193d4766d00239b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/733d4d95c0101d5f277b8e4910411d016e49a9dc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ef0a06acc6b16388640ad367eedfa2a17f1945db"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3HX8-25M4-F73Q
Vulnerability from github – Published: 2024-04-16 09:30 – Updated: 2024-04-16 09:30Out-of-Bounds read in ciCCIOTOPT in ASR180X will cause incorrect computations.
{
"affected": [],
"aliases": [
"CVE-2024-32631"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-16T09:15:07Z",
"severity": "HIGH"
},
"details": "Out-of-Bounds read in ciCCIOTOPT in ASR180X will cause incorrect computations.",
"id": "GHSA-3hx8-25m4-f73q",
"modified": "2024-04-16T09:30:33Z",
"published": "2024-04-16T09:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32631"
},
{
"type": "WEB",
"url": "https://www.asrmicro.com/en/goods/psirt?cid=38"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3HX9-JRQ9-5MH9
Vulnerability from github – Published: 2022-05-24 17:35 – Updated: 2022-05-24 17:35TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for "dc:format=\"image/dng\" within profile due to improper string handling, when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type instead of a raw C string to remedy this. This could cause an impact to availability of the application. This flaw affects ImageMagick versions prior to 7.0.9-0.
{
"affected": [],
"aliases": [
"CVE-2020-25667"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-08T21:15:00Z",
"severity": "MODERATE"
},
"details": "TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for `\"dc:format=\\\"image/dng\\\"` within `profile` due to improper string handling, when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type instead of a raw C string to remedy this. This could cause an impact to availability of the application. This flaw affects ImageMagick versions prior to 7.0.9-0.",
"id": "GHSA-3hx9-jrq9-5mh9",
"modified": "2022-05-24T17:35:32Z",
"published": "2022-05-24T17:35:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25667"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1891613"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3J2M-3XQ8-9948
Vulnerability from github – Published: 2026-06-25 09:31 – Updated: 2026-06-28 09:31In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack_irc: fix possible out-of-bounds read
When parsing fails after we've matched the command string we should bail out instead of trying to match a different command.
This helper should be deprecated, given prevalence of TLS I doubt it has any relevance in 2026.
{
"affected": [],
"aliases": [
"CVE-2026-53268"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-25T09:16:44Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack_irc: fix possible out-of-bounds read\n\nWhen parsing fails after we\u0027ve matched the command string we\nshould bail out instead of trying to match a different command.\n\nThis helper should be deprecated, given prevalence of TLS I doubt it has\nany relevance in 2026.",
"id": "GHSA-3j2m-3xq8-9948",
"modified": "2026-06-28T09:31:47Z",
"published": "2026-06-25T09:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53268"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0afc802160af0df61ed374fdb97fb34cfe5cdf2f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4cdda7f868f48e2f81579371584fdbdce37df2c8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/573810f61bcd6b6815e2ff53bbdd2b9c9d747176"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/66eba0ffce3b7e11449946b4cbbef8ea36112f56"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7c34f91305292083253df6a9f6c8ede02d4ccaea"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8a1d6e40dedfe1068aee094d851bd69e289c9fd6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9e5da2379f968a3ea5a6e38921ab6201576466dc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ddddd8271359961e403d11c90c9ba9fc38914f7e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.