CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
11889 vulnerabilities reference this CWE, most recent first.
GHSA-J4H2-JW6H-J8VX
Vulnerability from github – Published: 2022-09-17 00:00 – Updated: 2022-09-17 00:00Adobe Photoshop versions 22.5.8 (and earlier) and 23.4.2 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2022-38431"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-16T18:15:00Z",
"severity": "HIGH"
},
"details": "Adobe Photoshop versions 22.5.8 (and earlier) and 23.4.2 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-j4h2-jw6h-j8vx",
"modified": "2022-09-17T00:00:33Z",
"published": "2022-09-17T00:00:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38431"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/photoshop/apsb22-52.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J4MC-42J4-7JGG
Vulnerability from github – Published: 2022-05-24 17:02 – Updated: 2024-04-04 02:42In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment.c, related to init_min_max_mtime in fs/f2fs/segment.c (because the second argument to get_seg_entry is not validated).
{
"affected": [],
"aliases": [
"CVE-2019-19449"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-08T02:15:00Z",
"severity": "HIGH"
},
"details": "In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment.c, related to init_min_max_mtime in fs/f2fs/segment.c (because the second argument to get_seg_entry is not validated).",
"id": "GHSA-j4mc-42j4-7jgg",
"modified": "2024-04-04T02:42:21Z",
"published": "2022-05-24T17:02:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19449"
},
{
"type": "WEB",
"url": "https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19449"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20200103-0001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J4MR-9XW3-C9JX
Vulnerability from github – Published: 2019-05-31 23:47 – Updated: 2020-08-31 18:31Versions of base64-url before 2.0.0 are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input.
Recommendation
Update to version 2.0.0 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "base64-url"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": true,
"github_reviewed_at": "2019-05-31T23:45:33Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Versions of `base64-url` before 2.0.0 are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input.\n\n\n## Recommendation\n\nUpdate to version 2.0.0 or later.",
"id": "GHSA-j4mr-9xw3-c9jx",
"modified": "2020-08-31T18:31:43Z",
"published": "2019-05-31T23:47:01Z",
"references": [
{
"type": "WEB",
"url": "https://hackerone.com/reports/321692"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/660"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Out-of-bounds Read in base64-url"
}
GHSA-J4MV-2M42-3984
Vulnerability from github – Published: 2024-08-07 03:31 – Updated: 2024-08-07 03:31Out-of-bounds read in parsing connected object list in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory.
{
"affected": [],
"aliases": [
"CVE-2024-34634"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-07T02:15:40Z",
"severity": "MODERATE"
},
"details": "Out-of-bounds read in parsing connected object list in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory.",
"id": "GHSA-j4mv-2m42-3984",
"modified": "2024-08-07T03:31:28Z",
"published": "2024-08-07T03:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34634"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2024\u0026month=08"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J4QG-3QJ2-QQFV
Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2025-04-20 03:38libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-bmp.c:492:24.
{
"affected": [],
"aliases": [
"CVE-2017-9171"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-23T04:29:00Z",
"severity": "CRITICAL"
},
"details": "libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-bmp.c:492:24.",
"id": "GHSA-j4qg-3qj2-qqfv",
"modified": "2025-04-20T03:38:09Z",
"published": "2022-05-13T01:47:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9171"
},
{
"type": "WEB",
"url": "https://blogs.gentoo.org/ago/2017/05/20/autotrace-multiple-vulnerabilities-the-autotrace-nightmare"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J4R3-HG7J-8CHG
Vulnerability from github – Published: 2026-08-06 21:26 – Updated: 2026-08-06 21:26Summary
re2 infers a character's byte length from its UTF-8 lead byte alone, with no bound on the
bytes actually remaining in the input. Buffer arguments reach the native layer verbatim —
only strings are re-encoded into well-formed UTF-8 — so a Buffer whose last byte is a
multi-byte lead promises continuation bytes that are not there, and the result builders read
up to 3 bytes past the end of the buffer. In replace() and split() those bytes are copied
into the returned Buffer, disclosing adjacent heap memory to JavaScript. The trigger is
deterministic and requires no special heap grooming.
Only Buffer input is affected. String input was never at risk: re-encoding guarantees every
multi-byte sequence is complete.
Root cause
getUtf8CharSize maps a lead byte to a length of 1–4 and never sees the input size:
// lib/wrapped_re2.h
inline size_t getUtf8CharSize(char ch)
{
return ((0xE5000000 >> ((ch >> 3) & 0x1E)) & 3) + 1;
}
Callers then read that many bytes. In the zero-width branch of replace(), the guard proves
only that at least one byte remains:
// lib/replace.cc
else if ((size_t)offset < size)
{
auto sym_size = getUtf8CharSize(data[offset]); // may claim up to 4 bytes
result.append(data + offset, sym_size); // reads data[offset .. offset + 3]
byteIndex = offset + sym_size;
}
offset < size permits offset == size - 1, so a lead byte of 0xF0 makes append read
data[size], data[size + 1] and data[size + 2].
Seven read sites shared the defect:
| Site | Argument | Disclosed to JS |
|---|---|---|
lib/replace.cc (zero-width branch) |
subject | yes |
lib/replace.cc (callback replacer) |
subject | yes |
lib/replace.cc (replacement scan) |
replacement | yes |
lib/split.cc |
subject | yes |
lib/pattern.cc translateRegExp (x2) |
pattern | no |
lib/pattern.cc escapeRegExp |
pattern | no |
Three further callers were not vulnerable, because they use the result only to advance an
index and never dereference past the end: getUtf16PositionByCounter in lib/wrapped_re2.h
(clamps its return to the buffer size), lib/match.cc (the value feeds RE2::Match, which
rejects startpos > endpos), and the getMaxSubmatch scan in lib/replace.cc (an overshoot
just ends the loop).
Proof of concept
Each call returns more bytes than were supplied; the trailing bytes are heap contents and vary between runs.
const RE2 = require('re2');
const hex = buf => [...buf].map(b => b.toString(16).padStart(2, '0')).join(' ');
// subject: 2 bytes in, 5 bytes out
console.log(hex(new RE2('', 'g').replace(Buffer.from([0x41, 0xf0]), '')));
// 41 f0 61 7b eb <- last 3 bytes are adjacent heap memory
// replacement argument
console.log(hex(new RE2('A', 'g').replace(Buffer.from('A'), Buffer.from([0x42, 0xf0]))));
// 42 f0 41 26 d6
// split
console.log(new RE2('', 'g').split(Buffer.from([0x41, 0xf0])).map(hex));
// [ '41', 'f0 e2 e4 df' ]
0xC2 (2-byte lead) and 0xE2 (3-byte lead) over-read 1 and 2 bytes respectively; 0xF0
over-reads 3.
For the pattern path the over-read occurs in translateRegExp / escapeRegExp, which run
before RE2 validates the pattern, but RE2 then rejects the malformed input, so the bytes are
discarded rather than returned:
new RE2(Buffer.from([0xf0])); // SyntaxError: invalid UTF-8 — read already happened
Impact
Information disclosure (replace, split). Up to 3 bytes of heap memory adjacent to the
input buffer are returned to JavaScript per call. The read is repeatable, so an attacker who
controls Buffer input and observes output can sample heap memory incrementally. What lands
there depends on allocator layout and is not directly steerable, but it may include fragments
of other buffers.
Out-of-bounds read (pattern compilation). No disclosure path, since the malformed pattern is rejected — but the read is still undefined behavior and can fault if the buffer ends on a page boundary.
Applications that pass only strings, or only well-formed UTF-8 buffers, are unaffected. The
exposure matters most where re2 is used as intended: running patterns or subjects derived
from untrusted input.
Suggested fix
Clamp the inferred character size to the bytes that actually remain, at every site whose result indexes the buffer:
inline size_t getUtf8CharSize(char ch, size_t remaining)
{
size_t size = getUtf8CharSize(ch);
return size < remaining ? size : remaining;
}
This is O(1) and changes no algorithm's complexity. A truncated tail then round-trips as the
bytes it really holds, which preserves the documented contract that Buffer input is passed
through verbatim. Rejecting malformed UTF-8 in Buffer input would also close the hole, but
is a breaking API change.
Resolution
Fixed in re2@1.26.1.
All seven read sites now clamp the character size to the remaining input, so a Buffer ending
in a truncated multi-byte character round-trips as its own bytes instead of reading past the
end. Regression tests cover the subject, replacement and pattern positions for 2-, 3- and
4-byte leads, including partially truncated sequences.
Remediation: upgrade to re2@1.26.1 or later.
Workaround (if you cannot upgrade): pass strings rather than Buffers, or validate that
Buffer input is well-formed UTF-8 before calling replace, split, or the RE2
constructor — for example Buffer.compare(Buffer.from(buf.toString('utf8')), buf) === 0.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.26.0"
},
"package": {
"ecosystem": "npm",
"name": "re2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-71498"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-06T21:26:14Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\n`re2` infers a character\u0027s byte length from its UTF-8 lead byte alone, with no bound on the\nbytes actually remaining in the input. `Buffer` arguments reach the native layer verbatim \u2014\nonly strings are re-encoded into well-formed UTF-8 \u2014 so a `Buffer` whose last byte is a\nmulti-byte lead promises continuation bytes that are not there, and the result builders read\nup to 3 bytes past the end of the buffer. In `replace()` and `split()` those bytes are copied\ninto the returned `Buffer`, disclosing adjacent heap memory to JavaScript. The trigger is\ndeterministic and requires no special heap grooming.\n\nOnly `Buffer` input is affected. String input was never at risk: re-encoding guarantees every\nmulti-byte sequence is complete.\n\n## Root cause\n\n`getUtf8CharSize` maps a lead byte to a length of 1\u20134 and never sees the input size:\n\n```cpp\n// lib/wrapped_re2.h\ninline size_t getUtf8CharSize(char ch)\n{\n return ((0xE5000000 \u003e\u003e ((ch \u003e\u003e 3) \u0026 0x1E)) \u0026 3) + 1;\n}\n```\n\nCallers then read that many bytes. In the zero-width branch of `replace()`, the guard proves\nonly that at least *one* byte remains:\n\n```cpp\n// lib/replace.cc\nelse if ((size_t)offset \u003c size)\n{\n auto sym_size = getUtf8CharSize(data[offset]); // may claim up to 4 bytes\n result.append(data + offset, sym_size); // reads data[offset .. offset + 3]\n byteIndex = offset + sym_size;\n}\n```\n\n`offset \u003c size` permits `offset == size - 1`, so a lead byte of `0xF0` makes `append` read\n`data[size]`, `data[size + 1]` and `data[size + 2]`.\n\nSeven read sites shared the defect:\n\n| Site | Argument | Disclosed to JS |\n|---|---|---|\n| `lib/replace.cc` (zero-width branch) | subject | yes |\n| `lib/replace.cc` (callback replacer) | subject | yes |\n| `lib/replace.cc` (replacement scan) | replacement | yes |\n| `lib/split.cc` | subject | yes |\n| `lib/pattern.cc` `translateRegExp` (x2) | pattern | no |\n| `lib/pattern.cc` `escapeRegExp` | pattern | no |\n\nThree further callers were **not** vulnerable, because they use the result only to advance an\nindex and never dereference past the end: `getUtf16PositionByCounter` in `lib/wrapped_re2.h`\n(clamps its return to the buffer size), `lib/match.cc` (the value feeds `RE2::Match`, which\nrejects `startpos \u003e endpos`), and the `getMaxSubmatch` scan in `lib/replace.cc` (an overshoot\njust ends the loop).\n\n## Proof of concept\n\nEach call returns more bytes than were supplied; the trailing bytes are heap contents and vary\nbetween runs.\n\n```js\nconst RE2 = require(\u0027re2\u0027);\nconst hex = buf =\u003e [...buf].map(b =\u003e b.toString(16).padStart(2, \u00270\u0027)).join(\u0027 \u0027);\n\n// subject: 2 bytes in, 5 bytes out\nconsole.log(hex(new RE2(\u0027\u0027, \u0027g\u0027).replace(Buffer.from([0x41, 0xf0]), \u0027\u0027)));\n// 41 f0 61 7b eb \u003c- last 3 bytes are adjacent heap memory\n\n// replacement argument\nconsole.log(hex(new RE2(\u0027A\u0027, \u0027g\u0027).replace(Buffer.from(\u0027A\u0027), Buffer.from([0x42, 0xf0]))));\n// 42 f0 41 26 d6\n\n// split\nconsole.log(new RE2(\u0027\u0027, \u0027g\u0027).split(Buffer.from([0x41, 0xf0])).map(hex));\n// [ \u002741\u0027, \u0027f0 e2 e4 df\u0027 ]\n```\n\n`0xC2` (2-byte lead) and `0xE2` (3-byte lead) over-read 1 and 2 bytes respectively; `0xF0`\nover-reads 3.\n\nFor the pattern path the over-read occurs in `translateRegExp` / `escapeRegExp`, which run\nbefore RE2 validates the pattern, but RE2 then rejects the malformed input, so the bytes are\ndiscarded rather than returned:\n\n```js\nnew RE2(Buffer.from([0xf0])); // SyntaxError: invalid UTF-8 \u2014 read already happened\n```\n\n## Impact\n\n**Information disclosure (`replace`, `split`).** Up to 3 bytes of heap memory adjacent to the\ninput buffer are returned to JavaScript per call. The read is repeatable, so an attacker who\ncontrols `Buffer` input and observes output can sample heap memory incrementally. What lands\nthere depends on allocator layout and is not directly steerable, but it may include fragments\nof other buffers.\n\n**Out-of-bounds read (pattern compilation).** No disclosure path, since the malformed pattern\nis rejected \u2014 but the read is still undefined behavior and can fault if the buffer ends on a\npage boundary.\n\nApplications that pass only strings, or only well-formed UTF-8 buffers, are unaffected. The\nexposure matters most where `re2` is used as intended: running patterns or subjects derived\nfrom untrusted input.\n\n## Suggested fix\n\nClamp the inferred character size to the bytes that actually remain, at every site whose result\nindexes the buffer:\n\n```cpp\ninline size_t getUtf8CharSize(char ch, size_t remaining)\n{\n size_t size = getUtf8CharSize(ch);\n return size \u003c remaining ? size : remaining;\n}\n```\n\nThis is O(1) and changes no algorithm\u0027s complexity. A truncated tail then round-trips as the\nbytes it really holds, which preserves the documented contract that `Buffer` input is passed\nthrough verbatim. Rejecting malformed UTF-8 in `Buffer` input would also close the hole, but\nis a breaking API change.\n\n## Resolution\n\nFixed in `re2@1.26.1`.\n\nAll seven read sites now clamp the character size to the remaining input, so a `Buffer` ending\nin a truncated multi-byte character round-trips as its own bytes instead of reading past the\nend. Regression tests cover the subject, replacement and pattern positions for 2-, 3- and\n4-byte leads, including partially truncated sequences.\n\n**Remediation:** upgrade to `re2@1.26.1` or later.\n\n**Workaround** (if you cannot upgrade): pass strings rather than `Buffer`s, or validate that\n`Buffer` input is well-formed UTF-8 before calling `replace`, `split`, or the `RE2`\nconstructor \u2014 for example `Buffer.compare(Buffer.from(buf.toString(\u0027utf8\u0027)), buf) === 0`.\n\nReported by [@OvOhao](https://github.com/OvOhao) in [#272](https://github.com/uhop/node-re2/issues/272).",
"id": "GHSA-j4r3-hg7j-8chg",
"modified": "2026-08-06T21:26:14Z",
"published": "2026-08-06T21:26:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg"
},
{
"type": "WEB",
"url": "https://github.com/uhop/node-re2/issues/272"
},
{
"type": "WEB",
"url": "https://github.com/uhop/node-re2/commit/9d72042a6a0da5bc523908b04808ea0e23867cc4"
},
{
"type": "PACKAGE",
"url": "https://github.com/uhop/node-re2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character \u2192 adjacent heap memory disclosed to JavaScript"
}
GHSA-J4RG-VR7V-M3M8
Vulnerability from github – Published: 2022-09-17 00:00 – Updated: 2022-09-17 00:00Adobe InDesign versions 16.4.2 (and earlier) and 17.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2022-30674"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-16T18:15:00Z",
"severity": "MODERATE"
},
"details": "Adobe InDesign versions 16.4.2 (and earlier) and 17.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-j4rg-vr7v-m3m8",
"modified": "2022-09-17T00:00:32Z",
"published": "2022-09-17T00:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30674"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/indesign/apsb22-50.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSVZN3IJ6OCPSJL7AEX3ZHSHAHFOGESK"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LQB6FJAM5YQ35SF5B2MN25Y2FX56EOEZ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XCGBVQQ47URGJAZWHCISHDWF6QBTV2LE"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J4RX-V32X-Q49G
Vulnerability from github – Published: 2026-02-09 18:30 – Updated: 2026-02-09 18:30A vulnerability was determined in janet-lang janet up to 1.40.1. This impacts the function janetc_if of the file src/core/specials.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called c43e06672cd9dacf2122c99f362120a17c34b391. It is advisable to implement a patch to correct this issue.
{
"affected": [],
"aliases": [
"CVE-2026-2242"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-09T18:16:08Z",
"severity": "MODERATE"
},
"details": "A vulnerability was determined in janet-lang janet up to 1.40.1. This impacts the function janetc_if of the file src/core/specials.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called c43e06672cd9dacf2122c99f362120a17c34b391. It is advisable to implement a patch to correct this issue.",
"id": "GHSA-j4rx-v32x-q49g",
"modified": "2026-02-09T18:30:31Z",
"published": "2026-02-09T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2242"
},
{
"type": "WEB",
"url": "https://github.com/janet-lang/janet/issues/1700"
},
{
"type": "WEB",
"url": "https://github.com/janet-lang/janet/issues/1702"
},
{
"type": "WEB",
"url": "https://github.com/janet-lang/janet/commit/c43e06672cd9dacf2122c99f362120a17c34b391"
},
{
"type": "WEB",
"url": "https://github.com/janet-lang/janet"
},
{
"type": "WEB",
"url": "https://github.com/oneafter/0123/blob/main/ja2/repro"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.344981"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.344981"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.754495"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J4V3-95XV-Q35P
Vulnerability from github – Published: 2022-05-13 01:53 – Updated: 2025-04-20 03:48tcpdump before 4.9.3 has a heap-based buffer over-read related to aoe_print in print-aoe.c and lookup_emem in addrtoname.c.
{
"affected": [],
"aliases": [
"CVE-2017-16808"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-13T21:29:00Z",
"severity": "MODERATE"
},
"details": "tcpdump before 4.9.3 has a heap-based buffer over-read related to aoe_print in print-aoe.c and lookup_emem in addrtoname.c.",
"id": "GHSA-j4v3-95xv-q35p",
"modified": "2025-04-20T03:48:22Z",
"published": "2022-05-13T01:53:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16808"
},
{
"type": "WEB",
"url": "https://github.com/the-tcpdump-group/tcpdump/issues/645"
},
{
"type": "WEB",
"url": "https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Dec/23"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Oct/2"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT210788"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4252-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4252-2"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00065.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/154710/Slackware-Security-Advisory-tcpdump-Updates.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2019/Dec/26"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039773"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J4X2-V364-5PPC
Vulnerability from github – Published: 2025-09-23 15:31 – Updated: 2025-09-23 15:31In the Linux kernel, the following vulnerability has been resolved:
ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
If the NumEntries field in the _CPC return package is less than 2, do not attempt to access the "Revision" element of that package, because it may not be present then.
BugLink: https://lore.kernel.org/lkml/20220322143534.GC32582@xsang-OptiPlex-9020/
{
"affected": [],
"aliases": [
"CVE-2022-49145"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-26T07:00:51Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: CPPC: Avoid out of bounds access when parsing _CPC data\n\nIf the NumEntries field in the _CPC return package is less than 2, do\nnot attempt to access the \"Revision\" element of that package, because\nit may not be present then.\n\nBugLink: https://lore.kernel.org/lkml/20220322143534.GC32582@xsang-OptiPlex-9020/",
"id": "GHSA-j4x2-v364-5ppc",
"modified": "2025-09-23T15:31:07Z",
"published": "2025-09-23T15:31:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49145"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/28d5387c1994f5e1e0d41b30a1f3dd6e1f609252"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/40d8abf364bcab23bc715a9221a3c8623956257b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/97b5593fd1b182b3fdb180b6bbe64ec09669988b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b3f15609ffa521de12244cd6af24002030dda3f5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b80b19b32a432c9eee1cd200ef7aaddf608f54d1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cb249f8c00f40dba83b7da8207ac14ca46e9ec9e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d208ea44e25b31db5a4d5e8c31df51787a3e9303"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d7339f2a3938fb56b5f28d53f5345900b5fa0e74"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e5b681822cac1f8093759b02e16c06b2c64b6788"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.