Common Weakness Enumeration
CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
11813 vulnerabilities reference this CWE, most recent first.
GHSA-FF84-5F28-78QJ
Vulnerability from github – Published: 2026-07-31 16:53 – Updated: 2026-07-31 16:53
VLAI
Summary
re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)
Details
Summary
re2 validates the user-settable lastIndex against the subject's UTF-8 byte length but then uses it as a UTF-16 code-unit count to walk the subject buffer, with no bounds check. For any non-ASCII subject, the byte length is larger than the true character count, so a lastIndex between those two values passes validation while pointing past the end of the buffer. The subsequent walk reads out of bounds. With a large subject the read marches into unmapped memory and the process dies with SIGABRT/SIGSEGV — an uncatchable crash (try/catch cannot stop it), i.e. a denial of service for any worker/process that runs the match. In some cases the out-of-bounds bytes are copied into the returned value (a bounded, best-effort heap information leak).
Root cause
The subject wrapper stores the UTF-8 byte length in StrVal::length:
lib/addon.cc:200auto argLength = utf8Length(s, isolate);— UTF-8 byte countlib/addon.cc:209lastStringValue.reset(buffer, argSize, argLength, startFrom, false, isAscii);
setIndex then validates the (UTF-16) lastIndex against that byte length and walks the buffer by character count:
// lib/addon.cc:229
void StrVal::setIndex(size_t newIndex) {
isValidIndex = newIndex <= length; // length == UTF-8 BYTE length, not UTF-16 length
if (!isValidIndex) { index = newIndex; byteIndex = 0; return; }
...
// addon.cc:263
byteIndex = index < newIndex
? getUtf16PositionByCounter(data, byteIndex, newIndex - index)
: getUtf16PositionByCounter(data, 0, newIndex);
index = newIndex;
}
getUtf16PositionByCounter reads data[from] and advances by the UTF-8 char size with no check of from against the buffer size:
// lib/wrapped_re2.h:264
inline size_t getUtf16PositionByCounter(const char *data, size_t from, size_t n) {
for (; n > 0; --n) {
size_t s = getUtf8CharSize(data[from]); // <-- OOB read once `from` passes the buffer end
from += s;
if (s == 4 && n >= 2) --n;
}
return from;
}
lastIndex is user-settable to any positive integer (capped only at >= 0, no upper bound):
// lib/accessors.cc:166
NAN_SETTER(WrappedRE2::SetLastIndex) {
...
int n = value->NumberValue(...).FromMaybe(0);
re2->lastIndex = n <= 0 ? 0 : n; // no upper bound relative to the subject
}
For an ASCII subject the byte length equals the UTF-16 length, so the guard is correct — this only triggers on non-ASCII subjects. The out-of-bounds read happens inside prepareArgument for any global/sticky regex, reached by exec, test, String.prototype.match, replace, and split.
Proof of concept
Minimal (AddressSanitizer, deterministic OOB read):
const RE2 = require('re2');
const re = new RE2('a', 'y'); // sticky; 'g' also works
re.lastIndex = 3; // 3 <= byteLen(4) passes the guard; only 2 real chars exist
re.exec('éé'); // U+00E9 = 2 bytes each
Built with -fsanitize=address, this aborts with:
ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 1
#0 getUtf16PositionByCounter wrapped_re2.h:268
#1 StrVal::reset addon.cc:277
#2 WrappedRE2::prepareArgument addon.cc:209
#3 WrappedRE2::Exec exec.cc:17
The overflowed region is the subject buffer allocated by node::Buffer::New at addon.cc:205.
Real-world impact on the shipped prebuilt binary (no ASAN) — uncatchable crash:
const RE2 = require('re2');
const s = '中'.repeat(40000000); // UTF-16 length 40M, UTF-8 bytes 120M
const re = new RE2('a', 'y');
re.lastIndex = Buffer.byteLength(s) - 1; // passes the byte-length guard, far exceeds real char count
re.exec(s); // walks into unmapped memory -> SIGSEGV (exit 139)
try { ... } catch (e) {} around the call does not prevent termination — it is a native fault, not a JS exception. Validated on a clean npm install re2@1.25.1 (latest): stock prebuilt → SIGSEGV; ASAN build → the heap-buffer-overflow read above.
Impact
- Denial of service (primary): an uncatchable native crash that terminates the Node process/worker. Reachable remotely and without authentication wherever an application (a) uses a
globalorstickyRE2, (b) applies it to a non-ASCII subject, and (c) setslastIndexfrom attacker-influenced data (e.g. resuming a scan/pagination at a client-supplied offset). - Information disclosure (secondary, best-effort): the out-of-bounds
byteIndexcan cause adjacent heap bytes to be copied into the returned value (e.g. the leading segment of areplaceresult). This is bounded and unreliable — the subject buffer iscalloc-allocated (zero-filled) and the over-read distance depends on interpreting out-of-bounds bytes as UTF-8 sizes — so it is noted for completeness, not as a dependable primitive.
This is distinct from GHSA-8hcv-x26h-mcgp (the global replace() output-amplification abort), which was fixed in 1.25.1. This lastIndex out-of-bounds read is a separate defect and remains present in 1.25.1.
Suggested fix
Two independent hardenings; either closes the crash, both is safest:
- Bound the walk so it can never read past the buffer:
inline size_t getUtf16PositionByCounter(const char *data, size_t size, size_t from, size_t n) {
for (; n > 0 && from < size; --n) {
size_t s = getUtf8CharSize(data[from]);
from += s;
if (s == 4 && n >= 2) --n;
}
return from > size ? size : from;
}
(thread size through the two call sites in StrVal::setIndex).
- Validate
lastIndexagainst the true UTF-16 length, not the UTF-8 byte length — e.g. stores->Length()(UTF-16 units) as the value compared inisValidIndex = newIndex <= <utf16Length>, so an out-of-rangelastIndextakes the existing!isValidIndexearly-return path.
Resolution
Fixed in re2 1.25.2.
lastIndex is now validated against the subject's UTF-16 length instead of its
UTF-8 byte length (lib/addon.cc), so an out-of-range lastIndex is rejected
before the buffer is walked. As defense in depth, the code-unit walk
(getUtf16PositionByCounter in lib/wrapped_re2.h) is now bounded by the
buffer size and can no longer read past the end.
Remediation: upgrade to re2@1.25.2 or later.
Workaround (if you cannot upgrade): do not assign lastIndex from untrusted
input, or clamp it to the subject's string length (str.length) before calling
exec/test/match/replace/split on a non-ASCII subject.
Severity
5.7 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.25.1"
},
"package": {
"ecosystem": "npm",
"name": "re2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-67550"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-31T16:53:16Z",
"nvd_published_at": "2026-07-30T20:18:15Z",
"severity": "MODERATE"
},
"details": "## Summary\n\n`re2` validates the user-settable `lastIndex` against the subject\u0027s **UTF-8 byte length** but then uses it as a **UTF-16 code-unit count** to walk the subject buffer, with no bounds check. For any non-ASCII subject, the byte length is larger than the true character count, so a `lastIndex` between those two values passes validation while pointing past the end of the buffer. The subsequent walk reads out of bounds. With a large subject the read marches into unmapped memory and the process dies with **SIGABRT/SIGSEGV** \u2014 an uncatchable crash (`try/catch` cannot stop it), i.e. a denial of service for any worker/process that runs the match. In some cases the out-of-bounds bytes are copied into the returned value (a bounded, best-effort heap information leak).\n\n## Root cause\n\nThe subject wrapper stores the UTF-8 **byte** length in `StrVal::length`:\n\n- `lib/addon.cc:200` `auto argLength = utf8Length(s, isolate);` \u2014 UTF-8 **byte** count\n- `lib/addon.cc:209` `lastStringValue.reset(buffer, argSize, argLength, startFrom, false, isAscii);`\n\n`setIndex` then validates the (UTF-16) `lastIndex` against that byte length and walks the buffer by character count:\n\n```cpp\n// lib/addon.cc:229\nvoid StrVal::setIndex(size_t newIndex) {\n isValidIndex = newIndex \u003c= length; // length == UTF-8 BYTE length, not UTF-16 length\n if (!isValidIndex) { index = newIndex; byteIndex = 0; return; }\n ...\n // addon.cc:263\n byteIndex = index \u003c newIndex\n ? getUtf16PositionByCounter(data, byteIndex, newIndex - index)\n : getUtf16PositionByCounter(data, 0, newIndex);\n index = newIndex;\n}\n```\n\n`getUtf16PositionByCounter` reads `data[from]` and advances by the UTF-8 char size with **no check of `from` against the buffer size**:\n\n```cpp\n// lib/wrapped_re2.h:264\ninline size_t getUtf16PositionByCounter(const char *data, size_t from, size_t n) {\n for (; n \u003e 0; --n) {\n size_t s = getUtf8CharSize(data[from]); // \u003c-- OOB read once `from` passes the buffer end\n from += s;\n if (s == 4 \u0026\u0026 n \u003e= 2) --n;\n }\n return from;\n}\n```\n\n`lastIndex` is user-settable to any positive integer (capped only at `\u003e= 0`, no upper bound):\n\n```cpp\n// lib/accessors.cc:166\nNAN_SETTER(WrappedRE2::SetLastIndex) {\n ...\n int n = value-\u003eNumberValue(...).FromMaybe(0);\n re2-\u003elastIndex = n \u003c= 0 ? 0 : n; // no upper bound relative to the subject\n}\n```\n\nFor an ASCII subject the byte length equals the UTF-16 length, so the guard is correct \u2014 this only triggers on non-ASCII subjects. The out-of-bounds read happens inside `prepareArgument` for any `global`/`sticky` regex, reached by `exec`, `test`, `String.prototype.match`, `replace`, and `split`.\n\n## Proof of concept\n\n**Minimal (AddressSanitizer, deterministic OOB read):**\n\n```js\nconst RE2 = require(\u0027re2\u0027);\nconst re = new RE2(\u0027a\u0027, \u0027y\u0027); // sticky; \u0027g\u0027 also works\nre.lastIndex = 3; // 3 \u003c= byteLen(4) passes the guard; only 2 real chars exist\nre.exec(\u0027\u00e9\u00e9\u0027); // U+00E9 = 2 bytes each\n```\n\nBuilt with `-fsanitize=address`, this aborts with:\n\n```\nERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 1\n #0 getUtf16PositionByCounter wrapped_re2.h:268\n #1 StrVal::reset addon.cc:277\n #2 WrappedRE2::prepareArgument addon.cc:209\n #3 WrappedRE2::Exec exec.cc:17\n```\n\nThe overflowed region is the subject buffer allocated by `node::Buffer::New` at `addon.cc:205`.\n\n**Real-world impact on the shipped prebuilt binary (no ASAN) \u2014 uncatchable crash:**\n\n```js\nconst RE2 = require(\u0027re2\u0027);\nconst s = \u0027\u4e2d\u0027.repeat(40000000); // UTF-16 length 40M, UTF-8 bytes 120M\nconst re = new RE2(\u0027a\u0027, \u0027y\u0027);\nre.lastIndex = Buffer.byteLength(s) - 1; // passes the byte-length guard, far exceeds real char count\nre.exec(s); // walks into unmapped memory -\u003e SIGSEGV (exit 139)\n```\n\n`try { ... } catch (e) {}` around the call does **not** prevent termination \u2014 it is a native fault, not a JS exception. Validated on a clean `npm install re2@1.25.1` (latest): stock prebuilt \u2192 SIGSEGV; ASAN build \u2192 the heap-buffer-overflow read above.\n\n## Impact\n\n- **Denial of service (primary):** an uncatchable native crash that terminates the Node process/worker. Reachable remotely and without authentication wherever an application (a) uses a `global` or `sticky` `RE2`, (b) applies it to a non-ASCII subject, and (c) sets `lastIndex` from attacker-influenced data (e.g. resuming a scan/pagination at a client-supplied offset).\n- **Information disclosure (secondary, best-effort):** the out-of-bounds `byteIndex` can cause adjacent heap bytes to be copied into the returned value (e.g. the leading segment of a `replace` result). This is bounded and unreliable \u2014 the subject buffer is `calloc`-allocated (zero-filled) and the over-read distance depends on interpreting out-of-bounds bytes as UTF-8 sizes \u2014 so it is noted for completeness, not as a dependable primitive.\n\nThis is distinct from GHSA-8hcv-x26h-mcgp (the global `replace()` output-amplification abort), which was fixed in 1.25.1. This `lastIndex` out-of-bounds read is a separate defect and remains present in 1.25.1.\n\n## Suggested fix\n\nTwo independent hardenings; either closes the crash, both is safest:\n\n1. **Bound the walk** so it can never read past the buffer:\n\n```cpp\ninline size_t getUtf16PositionByCounter(const char *data, size_t size, size_t from, size_t n) {\n for (; n \u003e 0 \u0026\u0026 from \u003c size; --n) {\n size_t s = getUtf8CharSize(data[from]);\n from += s;\n if (s == 4 \u0026\u0026 n \u003e= 2) --n;\n }\n return from \u003e size ? size : from;\n}\n```\n(thread `size` through the two call sites in `StrVal::setIndex`).\n\n2. **Validate `lastIndex` against the true UTF-16 length**, not the UTF-8 byte length \u2014 e.g. store `s-\u003eLength()` (UTF-16 units) as the value compared in `isValidIndex = newIndex \u003c= \u003cutf16Length\u003e`, so an out-of-range `lastIndex` takes the existing `!isValidIndex` early-return path.\n\n## Resolution\n\nFixed in re2 1.25.2.\n\n`lastIndex` is now validated against the subject\u0027s UTF-16 length instead of its\nUTF-8 byte length (`lib/addon.cc`), so an out-of-range `lastIndex` is rejected\nbefore the buffer is walked. As defense in depth, the code-unit walk\n(`getUtf16PositionByCounter` in `lib/wrapped_re2.h`) is now bounded by the\nbuffer size and can no longer read past the end.\n\n**Remediation:** upgrade to `re2@1.25.2` or later.\n\n**Workaround** (if you cannot upgrade): do not assign `lastIndex` from untrusted\ninput, or clamp it to the subject\u0027s string length (`str.length`) before calling\n`exec`/`test`/`match`/`replace`/`split` on a non-ASCII subject.",
"id": "GHSA-ff84-5f28-78qj",
"modified": "2026-07-31T16:53:16Z",
"published": "2026-07-31T16:53:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67550"
},
{
"type": "WEB",
"url": "https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d"
},
{
"type": "PACKAGE",
"url": "https://github.com/uhop/node-re2"
},
{
"type": "WEB",
"url": "https://github.com/uhop/node-re2/releases/tag/1.25.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject \u2192 uncatchable process crash (DoS)"
}
GHSA-FF8R-G78Q-G9WH
Vulnerability from github – Published: 2024-09-18 15:30 – Updated: 2024-09-20 21:31
VLAI
Details
Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of10::StatsReplyTable::unpack.
This issue affects libfluid: 0.1.0.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-31172"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-18T14:15:14Z",
"severity": "MODERATE"
},
"details": "Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine\u00a0fluid_msg::of10::StatsReplyTable::unpack.\n\nThis issue affects libfluid: 0.1.0.",
"id": "GHSA-ff8r-g78q-g9wh",
"modified": "2024-09-20T21:31:38Z",
"published": "2024-09-18T15:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31172"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31172"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-FF96-Q628-F339
Vulnerability from github – Published: 2023-01-26 21:30 – Updated: 2024-11-27 21:32
VLAI
Details
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18660.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-42391"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-26T18:59:00Z",
"severity": "MODERATE"
},
"details": "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18660.",
"id": "GHSA-ff96-q628-f339",
"modified": "2024-11-27T21:32:38Z",
"published": "2023-01-26T21:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42391"
},
{
"type": "WEB",
"url": "https://www.tracker-software.com/product/pdf-xchange-editor/history"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1382"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FFC3-699F-F9R7
Vulnerability from github – Published: 2022-05-13 01:22 – Updated: 2022-05-13 01:22
VLAI
Details
GattLib 0.2 has a stack-based buffer over-read in gattlib_connect in dbus/gattlib.c because strncpy is misused.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2019-6498"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-21T06:29:00Z",
"severity": "HIGH"
},
"details": "GattLib 0.2 has a stack-based buffer over-read in gattlib_connect in dbus/gattlib.c because strncpy is misused.",
"id": "GHSA-ffc3-699f-f9r7",
"modified": "2022-05-13T01:22:43Z",
"published": "2022-05-13T01:22:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6498"
},
{
"type": "WEB",
"url": "https://github.com/labapart/gattlib/issues/81"
},
{
"type": "WEB",
"url": "https://github.com/labapart/gattlib/issues/82"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/46215"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FFCJ-M49C-V7QJ
Vulnerability from github – Published: 2022-05-13 01:46 – Updated: 2022-05-13 01:46
VLAI
Details
The PoDoFo::PdfPainter::ExpandTabs function in PdfPainter.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PDF document.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-7378"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-03T05:59:00Z",
"severity": "MODERATE"
},
"details": "The PoDoFo::PdfPainter::ExpandTabs function in PdfPainter.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PDF document.",
"id": "GHSA-ffcj-m49c-v7qj",
"modified": "2022-05-13T01:46:57Z",
"published": "2022-05-13T01:46:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7378"
},
{
"type": "WEB",
"url": "https://blogs.gentoo.org/ago/2017/03/31/podofo-heap-based-buffer-overflow-in-podofopdfpainterexpandtabs-pdfpainter-cpp"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97296"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FFF6-82FR-Q9XP
Vulnerability from github – Published: 2023-03-29 21:30 – Updated: 2023-04-06 21:30
VLAI
Details
This vulnerability allows remote attackers to disclose sensitive information on affected installations of RARLAB WinRAR 6.11.0.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ZIP files. Crafted data in a ZIP file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-19232.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2022-43650"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-29T19:15:00Z",
"severity": "HIGH"
},
"details": "This vulnerability allows remote attackers to disclose sensitive information on affected installations of RARLAB WinRAR 6.11.0.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ZIP files. Crafted data in a ZIP file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-19232.",
"id": "GHSA-fff6-82fr-q9xp",
"modified": "2023-04-06T21:30:20Z",
"published": "2023-03-29T21:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43650"
},
{
"type": "WEB",
"url": "https://www.win-rar.com/singlenewsview.html?\u0026L=0\u0026tx_ttnews%5Btt_news%5D=216\u0026cHash=983dfbcc83fb1b64a5f792891a281709"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-092"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FFGG-JPJ7-C6Q2
Vulnerability from github – Published: 2022-05-13 01:13 – Updated: 2022-05-13 01:13
VLAI
Details
The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted VIFF file.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2016-7528"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-19T14:59:00Z",
"severity": "MODERATE"
},
"details": "The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted VIFF file.",
"id": "GHSA-ffgg-jpj7-c6q2",
"modified": "2022-05-13T01:13:32Z",
"published": "2022-05-13T01:13:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7528"
},
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/issues/99"
},
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/commit/7be16a280014f895a951db4948df316a23dabc09"
},
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/commit/ca0c886abd6d3ef335eb74150cd23b89ebd17135"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1537425"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1378760"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/09/22/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93226"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FFGW-JRQ3-GRX9
Vulnerability from github – Published: 2025-06-10 18:32 – Updated: 2025-06-10 18:32
VLAI
Details
Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-32720"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-10T17:22:02Z",
"severity": "MODERATE"
},
"details": "Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.",
"id": "GHSA-ffgw-jrq3-grx9",
"modified": "2025-06-10T18:32:28Z",
"published": "2025-06-10T18:32:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32720"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32720"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FFHM-887W-W24Q
Vulnerability from github – Published: 2022-05-24 19:11 – Updated: 2022-05-24 19:11
VLAI
Details
In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-187231636
{
"affected": [],
"aliases": [
"CVE-2021-0579"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-17T19:15:00Z",
"severity": "MODERATE"
},
"details": "In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-187231636",
"id": "GHSA-ffhm-887w-w24q",
"modified": "2022-05-24T19:11:24Z",
"published": "2022-05-24T19:11:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0579"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2021-08-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FFJF-GPWV-J22H
Vulnerability from github – Published: 2022-05-13 01:48 – Updated: 2025-04-20 03:41
VLAI
Details
The Ins_MDRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2017-9726"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-26T19:29:00Z",
"severity": "HIGH"
},
"details": "The Ins_MDRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.",
"id": "GHSA-ffjf-gpwv-j22h",
"modified": "2025-04-20T03:41:28Z",
"published": "2022-05-13T01:48:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9726"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201811-12"
},
{
"type": "WEB",
"url": "http://bugs.ghostscript.com/show_bug.cgi?id=698055"
},
{
"type": "WEB",
"url": "http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=7755e67116e8973ee0e3b22d653df026a84fa01b"
},
{
"type": "WEB",
"url": "http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=7755e67116e8973ee0e3b22d653df026a84fa01b"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3986"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99992"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.