GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-125

Allowed

Out-of-bounds Read

Abstraction: Base · Status: Draft

The product reads data past the end, or before the beginning, of the intended buffer.

12334 vulnerabilities reference this CWE, most recent first.

GHSA-JXVQ-QF85-7WHF

Vulnerability from github – Published: 2025-03-05 06:31 – Updated: 2025-03-05 15:30
VLAI
Details

Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file. (Chromium security severity: Medium)

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2025-1918"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-05T04:15:11Z",
    "severity": "HIGH"
  },
  "details": "Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file. (Chromium security severity: Medium)",
  "id": "GHSA-jxvq-qf85-7whf",
  "modified": "2025-03-05T15:30:55Z",
  "published": "2025-03-05T06:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1918"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/388557904"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M222-CMHP-V9M7

Vulnerability from github – Published: 2023-02-14 00:30 – Updated: 2025-03-21 21:31
VLAI
Details

LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2023-0796"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-13T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.",
  "id": "GHSA-m222-cmhp-v9m7",
  "modified": "2025-03-21T21:31:32Z",
  "published": "2023-02-14T00:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0796"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0796.json"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/libtiff/libtiff/-/issues/499"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00026.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202305-31"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20230316-0003"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2023/dsa-5361"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M22H-XR4X-3Q2G

Vulnerability from github – Published: 2022-05-13 01:49 – Updated: 2022-05-13 01:49
VLAI
Details

In libpbc.a in PBC through 2017-03-02, there is a buffer over-read in calc_hash in map.c.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2018-12915"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-06-27T18:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "In libpbc.a in PBC through 2017-03-02, there is a buffer over-read in calc_hash in map.c.",
  "id": "GHSA-m22h-xr4x-3q2g",
  "modified": "2022-05-13T01:49:41Z",
  "published": "2022-05-13T01:49:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12915"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cloudwu/pbc/issues/118"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M24G-Q7XM-F893

Vulnerability from github – Published: 2026-08-11 18:31 – Updated: 2026-08-11 18:31
VLAI
Details

Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-62703"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-11T17:18:20Z",
    "severity": "MODERATE"
  },
  "details": "Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.",
  "id": "GHSA-m24g-q7xm-f893",
  "modified": "2026-08-11T18:31:12Z",
  "published": "2026-08-11T18:31:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62703"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62703"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M264-RXP9-QM6V

Vulnerability from github – Published: 2023-05-10 18:30 – Updated: 2025-11-04 21:30
VLAI
Details

An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulnerability.This vulnerability occurs when no port argument is provided to the PORT command.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2022-46378"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125",
      "CWE-823"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-10T16:15:10Z",
    "severity": "HIGH"
  },
  "details": "An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulnerability.This vulnerability occurs when no port argument is provided to the `PORT` command.",
  "id": "GHSA-m264-rxp9-qm6v",
  "modified": "2025-11-04T21:30:33Z",
  "published": "2023-05-10T18:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46378"
    },
    {
      "type": "WEB",
      "url": "https://github.com/weston-embedded/uC-FTPs/pull/2"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1681"
    },
    {
      "type": "WEB",
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1681"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M276-429X-F63W

Vulnerability from github – Published: 2026-07-30 06:32 – Updated: 2026-07-30 06:32
VLAI
Details

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-16530"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-30T06:25:03Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system\u0027s memory.",
  "id": "GHSA-m276-429x-f63w",
  "modified": "2026-07-30T06:32:37Z",
  "published": "2026-07-30T06:32:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16530"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16530"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506033"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M27M-5MQJ-H84F

Vulnerability from github – Published: 2026-09-12 18:30 – Updated: 2026-09-12 18:30
VLAI
Details

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_unit() when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a crash or limited heap memory exposure when loaded.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-90557"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-12T18:16:44Z",
    "severity": "MODERATE"
  },
  "details": "Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_unit() when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a crash or limited heap memory exposure when loaded.",
  "id": "GHSA-m27m-5mqj-h84f",
  "modified": "2026-09-12T18:30:22Z",
  "published": "2026-09-12T18:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90557"
    },
    {
      "type": "WEB",
      "url": "https://github.com/freeciv/freeciv/commit/ef0c76c2765fe383140eb1a70dbea1228844152e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/freeciv/freeciv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame2.c#L4282"
    },
    {
      "type": "WEB",
      "url": "https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame3.c#L6108"
    },
    {
      "type": "WEB",
      "url": "https://github.com/freeciv/freeciv/releases/tag/R3_2_6"
    },
    {
      "type": "WEB",
      "url": "https://redmine.freeciv.org/issues/2162"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/freeciv-3.1.0-through-3.2.5-out-of-bounds-read-via-savegame"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-M288-F8H5-GXR4

Vulnerability from github – Published: 2024-04-01 03:30 – Updated: 2024-07-03 18:34
VLAI
Details

In da, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541746; Issue ID: ALPS08541746.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2024-20041"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-01T03:15:07Z",
    "severity": "MODERATE"
  },
  "details": "In da, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541746; Issue ID: ALPS08541746.",
  "id": "GHSA-m288-f8h5-gxr4",
  "modified": "2024-07-03T18:34:00Z",
  "published": "2024-04-01T03:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20041"
    },
    {
      "type": "WEB",
      "url": "https://corp.mediatek.com/product-security-bulletin/April-2024"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M28F-FMGF-V7CW

Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-09-03 18:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

usb: misc: usbio: bound bulk IN response length to the received transfer

usbio_bulk_msg() copies bpkt_len = le16_to_cpu(bpkt->len) bytes out of the bulk IN buffer (usbio->rxbuf, allocated with size usbio->rxbuf_len) into the caller's buffer. bpkt_len is fully controlled by the device and is only checked against ibuf_len; ibuf_len in turn is checked against usbio->txbuf_len, not against rxbuf_len:

if ((obuf_len > (usbio->txbuf_len - sizeof(*bpkt))) ||
    (ibuf_len > (usbio->txbuf_len - sizeof(*bpkt))))
    return -EMSGSIZE;

txbuf_len and rxbuf_len are taken independently from the bulk OUT and bulk IN endpoint wMaxPacketSize in usbio_probe(). A malicious or malfunctioning device that advertises a large bulk OUT endpoint and a small bulk IN endpoint (e.g. by claiming one of the quirk-free IDs such as the Lattice NX33U, 0x2ac1:0x20cb) therefore makes ibuf_len, and hence the device-supplied bpkt_len, exceed rxbuf_len. memcpy() then reads up to txbuf_len - rxbuf_len bytes past the end of the rxbuf slab object. The over-read bytes are handed back to the i2c layer and on to user space through i2c-dev, disclosing adjacent slab memory; with KASAN this is reported as a slab-out-of-bounds read.

The number of bytes actually received is already known: act equals the URB actual_length and is bounded by rxbuf_len. Reject any response that claims more payload than was received, mirroring the existing "act < sizeof(*bpkt)" check just above.

The control path (usbio_ctrl_msg()) is not affected: it uses a single buffer (ctrlbuf) for both directions, so its analogous copy can never leave the allocation.

Found by code review. The out-of-bounds read was confirmed under AddressSanitizer with a faithful userspace model of usbio_bulk_msg()'s receive path (an rxbuf_len-sized buffer, the same act/ibuf_len/bpkt_len checks and the memcpy). A USB raw-gadget + dummy_hcd reproducer is also available.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-64339"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:15Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: misc: usbio: bound bulk IN response length to the received transfer\n\nusbio_bulk_msg() copies bpkt_len = le16_to_cpu(bpkt-\u003elen) bytes out of\nthe bulk IN buffer (usbio-\u003erxbuf, allocated with size usbio-\u003erxbuf_len)\ninto the caller\u0027s buffer.  bpkt_len is fully controlled by the device\nand is only checked against ibuf_len; ibuf_len in turn is checked\nagainst usbio-\u003etxbuf_len, not against rxbuf_len:\n\n\tif ((obuf_len \u003e (usbio-\u003etxbuf_len - sizeof(*bpkt))) ||\n\t    (ibuf_len \u003e (usbio-\u003etxbuf_len - sizeof(*bpkt))))\n\t\treturn -EMSGSIZE;\n\ntxbuf_len and rxbuf_len are taken independently from the bulk OUT and\nbulk IN endpoint wMaxPacketSize in usbio_probe().  A malicious or\nmalfunctioning device that advertises a large bulk OUT endpoint and a\nsmall bulk IN endpoint (e.g. by claiming one of the quirk-free IDs such\nas the Lattice NX33U, 0x2ac1:0x20cb) therefore makes ibuf_len, and\nhence the device-supplied bpkt_len, exceed rxbuf_len.  memcpy() then\nreads up to txbuf_len - rxbuf_len bytes past the end of the rxbuf slab\nobject.  The over-read bytes are handed back to the i2c layer and on to\nuser space through i2c-dev, disclosing adjacent slab memory; with KASAN\nthis is reported as a slab-out-of-bounds read.\n\nThe number of bytes actually received is already known: act equals the\nURB actual_length and is bounded by rxbuf_len.  Reject any response\nthat claims more payload than was received, mirroring the existing\n\"act \u003c sizeof(*bpkt)\" check just above.\n\nThe control path (usbio_ctrl_msg()) is not affected: it uses a single\nbuffer (ctrlbuf) for both directions, so its analogous copy can never\nleave the allocation.\n\nFound by code review.  The out-of-bounds read was confirmed under\nAddressSanitizer with a faithful userspace model of usbio_bulk_msg()\u0027s\nreceive path (an rxbuf_len-sized buffer, the same act/ibuf_len/bpkt_len\nchecks and the memcpy).  A USB raw-gadget + dummy_hcd reproducer is\nalso available.",
  "id": "GHSA-m28f-fmgf-v7cw",
  "modified": "2026-09-03T18:31:17Z",
  "published": "2026-07-25T12:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64339"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/48394f94211cf8fe0ea8604fc441633abf90fc94"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8c6314489550fa81d41723a0ff33f655b5b6c7b6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fc1b546973c1442d5b947fcdd03581f20ecc5bd2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M28H-7PHP-JRHG

Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-07-20 15:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix netfs_read_to_pagecache() to pause on subreq failure

Fix netfs_read_to_pagecache() so that it pauses the generation of new subrequests if an already-issued subrequest fails.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-64066"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-19T16:17:47Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix netfs_read_to_pagecache() to pause on subreq failure\n\nFix netfs_read_to_pagecache() so that it pauses the generation of new\nsubrequests if an already-issued subrequest fails.",
  "id": "GHSA-m28h-7php-jrhg",
  "modified": "2026-07-20T15:31:58Z",
  "published": "2026-07-19T18:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64066"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0256e79ce42101ad036edd4205bccca621ea0927"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/884c4c4f35e577aba6a0593c80cbea9ca5e6e2b8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Mitigation MIT-5
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design

Strategy: Language Selection

Use a language that provides appropriate memory abstractions.

CAPEC-540: Overread Buffers

An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.