Common Weakness Enumeration
CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
11678 vulnerabilities reference this CWE, most recent first.
GHSA-8GW8-R4QF-MQMQ
Vulnerability from github – Published: 2022-05-13 01:44 – Updated: 2022-05-13 01:44
VLAI
Details
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, while processing PTT commands, ptt_sock_send_msg_to_app() is invoked without validating the packet length. If the packet length is invalid, then a buffer over-read can occur.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-15853"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-03T17:29:00Z",
"severity": "MODERATE"
},
"details": "In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, while processing PTT commands, ptt_sock_send_msg_to_app() is invoked without validating the packet length. If the packet length is invalid, then a buffer over-read can occur.",
"id": "GHSA-8gw8-r4qf-mqmq",
"modified": "2022-05-13T01:44:01Z",
"published": "2022-05-13T01:44:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15853"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2018-04-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8GWJ-4MVC-6737
Vulnerability from github – Published: 2025-04-07 12:33 – Updated: 2025-04-07 12:33
VLAI
Details
Memory corruption while IOCTL call is invoked from user-space to read board data.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2025-21438"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-07T11:15:52Z",
"severity": "HIGH"
},
"details": "Memory corruption while IOCTL call is invoked from user-space to read board data.",
"id": "GHSA-8gwj-4mvc-6737",
"modified": "2025-04-07T12:33:19Z",
"published": "2025-04-07T12:33:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21438"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8H2Q-PRR9-7WH9
Vulnerability from github – Published: 2022-05-24 17:33 – Updated: 2022-05-24 17:33
VLAI
Details
libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
{
"affected": [],
"aliases": [
"CVE-2020-28241"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-06T05:15:00Z",
"severity": "MODERATE"
},
"details": "libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.",
"id": "GHSA-8h2q-prr9-7wh9",
"modified": "2022-05-24T17:33:20Z",
"published": "2022-05-24T17:33:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28241"
},
{
"type": "WEB",
"url": "https://github.com/maxmind/libmaxminddb/issues/236"
},
{
"type": "WEB",
"url": "https://github.com/maxmind/libmaxminddb/pull/237"
},
{
"type": "WEB",
"url": "https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00019.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6WUK4UCOB5FJVK36E22IRLEYGKMUWGBG"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ELTOHZBPO6XVUVADP4DPZBNQCPTYOQBV"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202011-15"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8H36-WFWW-P7V6
Vulnerability from github – Published: 2026-06-03 18:33 – Updated: 2026-06-05 09:33
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix out-of-bounds stream encoder index v3
eng_id can be negative and that stream_enc_regs[] can be indexed out of bounds.
eng_id is used directly as an index into stream_enc_regs[], which has only 5 entries. When eng_id is 5 (ENGINE_ID_DIGF) or negative, this can access memory past the end of the array.
Add a bounds check using ARRAY_SIZE() before using eng_id as an index. The unsigned cast also rejects negative values.
This avoids out-of-bounds access.
Fixes the below smatch error: dcn*_resource.c: stream_encoder_create() may index stream_enc_regs[eng_id] out of bounds (size 5).
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn351/dcn351_resource.c 1246 static struct stream_encoder dcn35_stream_encoder_create( 1247 enum engine_id eng_id, 1248 struct dc_context ctx) 1249 {
...
1255
1256 /* Mapping of VPG, AFMT, DME register blocks to DIO block instance */
1257 if (eng_id <= ENGINE_ID_DIGF) {
ENGINE_ID_DIGF is 5. should <= be <?
Unrelated but, ugh, why is Smatch saying that "eng_id" can be negative? end_id is type signed long, but there are checks in the caller which prevent it from being negative.
1258 vpg_inst = eng_id;
1259 afmt_inst = eng_id;
1260 } else
1261 return NULL;
1262
...
1281
1282 dcn35_dio_stream_encoder_construct(enc1, ctx, ctx->dc_bios,
1283 eng_id, vpg, afmt,
--> 1284 &stream_enc_regs[eng_id], ^^^^^^^^^^^^^^^^^^^^^^^ This stream_enc_regs[] array has 5 elements so we are one element beyond the end of the array.
...
1287 return &enc1->base;
1288 }
v2: use explicit bounds check as suggested by Roman/Dan; avoid unsigned int cast
v3: The compiler already knows how to compare the two values, so the cast (int) is not needed. (Roman)
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-46263"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-03T18:16:27Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix out-of-bounds stream encoder index v3\n\neng_id can be negative and that stream_enc_regs[]\ncan be indexed out of bounds.\n\neng_id is used directly as an index into stream_enc_regs[], which has\nonly 5 entries. When eng_id is 5 (ENGINE_ID_DIGF) or negative, this can\naccess memory past the end of the array.\n\nAdd a bounds check using ARRAY_SIZE() before using eng_id as an index.\nThe unsigned cast also rejects negative values.\n\nThis avoids out-of-bounds access.\n\nFixes the below smatch error:\ndcn*_resource.c: stream_encoder_create() may index\nstream_enc_regs[eng_id] out of bounds (size 5).\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn351/dcn351_resource.c\n 1246 static struct stream_encoder *dcn35_stream_encoder_create(\n 1247 enum engine_id eng_id,\n 1248 struct dc_context *ctx)\n 1249 {\n\n ...\n\n 1255\n 1256 /* Mapping of VPG, AFMT, DME register blocks to DIO block instance */\n 1257 if (eng_id \u003c= ENGINE_ID_DIGF) {\n\nENGINE_ID_DIGF is 5. should \u003c= be \u003c?\n\nUnrelated but, ugh, why is Smatch saying that \"eng_id\" can be negative?\nend_id is type signed long, but there are checks in the caller which prevent it from being negative.\n\n 1258 vpg_inst = eng_id;\n 1259 afmt_inst = eng_id;\n 1260 } else\n 1261 return NULL;\n 1262\n\n ...\n\n 1281\n 1282 dcn35_dio_stream_encoder_construct(enc1, ctx, ctx-\u003edc_bios,\n 1283 eng_id, vpg, afmt,\n--\u003e 1284 \u0026stream_enc_regs[eng_id],\n ^^^^^^^^^^^^^^^^^^^^^^^ This stream_enc_regs[] array has 5 elements so we are one element beyond the end of the array.\n\n ...\n\n 1287 return \u0026enc1-\u003ebase;\n 1288 }\n\nv2: use explicit bounds check as suggested by Roman/Dan; avoid unsigned int cast\n\nv3: The compiler already knows how to compare the two values, so the\n cast (int) is not needed. (Roman)",
"id": "GHSA-8h36-wfww-p7v6",
"modified": "2026-06-05T09:33:46Z",
"published": "2026-06-03T18:33:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46263"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/263e28add4f4472cfa95150d218955d1945aa413"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/29f3824b08a98d41ecbbfd33580630d7607f962e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/abde491143e4e12eecc41337910aace4e8d59603"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ca3808d560ad946ab6d089fd1f5bee04b952ead4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8H3R-68M6-VM7C
Vulnerability from github – Published: 2025-08-07 21:31 – Updated: 2026-05-12 15:30
VLAI
Details
In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2025-47219"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-07T20:15:27Z",
"severity": "HIGH"
},
"details": "In GStreamer through 1.26.1, the isomp4 plugin\u0027s qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.",
"id": "GHSA-8h3r-68m6-vm7c",
"modified": "2026-05-12T15:30:58Z",
"published": "2025-08-07T21:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47219"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
},
{
"type": "WEB",
"url": "https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md"
},
{
"type": "WEB",
"url": "https://gstreamer.freedesktop.org/security"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8H4W-44QV-79MQ
Vulnerability from github – Published: 2025-05-23 18:32 – Updated: 2025-11-03 21:33
VLAI
Details
parse_string in cJSON before 1.7.18 has a heap-based buffer over-read via {"1":1, with no trailing newline if cJSON_ParseWithLength is called.
Severity
{
"affected": [],
"aliases": [
"CVE-2023-53154"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-23T16:15:22Z",
"severity": "LOW"
},
"details": "parse_string in cJSON before 1.7.18 has a heap-based buffer over-read via {\"1\":1, with no trailing newline if cJSON_ParseWithLength is called.",
"id": "GHSA-8h4w-44qv-79mq",
"modified": "2025-11-03T21:33:57Z",
"published": "2025-05-23T18:32:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53154"
},
{
"type": "WEB",
"url": "https://github.com/DaveGamble/cJSON/issues/800"
},
{
"type": "WEB",
"url": "https://github.com/DaveGamble/cJSON/compare/v1.7.17...v1.7.18"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00014.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8H6F-6774-3WXG
Vulnerability from github – Published: 2022-05-13 01:48 – Updated: 2022-05-13 01:48
VLAI
Details
A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2018-1000122"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-14T18:29:00Z",
"severity": "CRITICAL"
},
"details": "A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage",
"id": "GHSA-8h6f-6774-3wxg",
"modified": "2022-05-13T01:48:32Z",
"published": "2022-05-13T01:48:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000122"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2019:0327"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3157"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3558"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1543"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0544"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0594"
},
{
"type": "WEB",
"url": "https://curl.haxx.se/docs/adv_2018-b047.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3598-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3598-2"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4136"
},
{
"type": "WEB",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103436"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040530"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8H79-9MCX-WQXG
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-05-24 19:20
VLAI
Details
An Out-of-bounds Read vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.11. Crafted data in a DGN file and lack of verification of input data can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
{
"affected": [],
"aliases": [
"CVE-2021-43273"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-14T21:15:00Z",
"severity": "MODERATE"
},
"details": "An Out-of-bounds Read vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.11. Crafted data in a DGN file and lack of verification of input data can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.",
"id": "GHSA-8h79-9mcx-wqxg",
"modified": "2022-05-24T19:20:39Z",
"published": "2022-05-24T19:20:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43273"
},
{
"type": "WEB",
"url": "https://www.opendesign.com/security-advisories"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1281"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1291"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1351"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1357"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8H8G-444F-4C9H
Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2025-04-20 03:38
VLAI
Details
libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the pnm_load_raw function in input-pnm.c:346:41.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2017-9152"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-23T04:29:00Z",
"severity": "CRITICAL"
},
"details": "libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the pnm_load_raw function in input-pnm.c:346:41.",
"id": "GHSA-8h8g-444f-4c9h",
"modified": "2025-04-20T03:38:07Z",
"published": "2022-05-13T01:47:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9152"
},
{
"type": "WEB",
"url": "https://blogs.gentoo.org/ago/2017/05/20/autotrace-multiple-vulnerabilities-the-autotrace-nightmare"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8H8P-QHMC-F4WR
Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2022-05-13 01:47
VLAI
Details
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip, that SHT_REL/SHR_RELA sections are always named starting with a .rel/.rela prefix. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy and strip, to crash.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2017-8393"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-01T18:59:00Z",
"severity": "HIGH"
},
"details": "The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip, that SHT_REL/SHR_RELA sections are always named starting with a .rel/.rela prefix. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy and strip, to crash.",
"id": "GHSA-8h8p-qhmc-f4wr",
"modified": "2022-05-13T01:47:31Z",
"published": "2022-05-13T01:47:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8393"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201709-02"
},
{
"type": "WEB",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=21412"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.