CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
12334 vulnerabilities reference this CWE, most recent first.
GHSA-JXVQ-QF85-7WHF
Vulnerability from github – Published: 2025-03-05 06:31 – Updated: 2025-03-05 15:30Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2025-1918"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-05T04:15:11Z",
"severity": "HIGH"
},
"details": "Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file. (Chromium security severity: Medium)",
"id": "GHSA-jxvq-qf85-7whf",
"modified": "2025-03-05T15:30:55Z",
"published": "2025-03-05T06:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1918"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/388557904"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M222-CMHP-V9M7
Vulnerability from github – Published: 2023-02-14 00:30 – Updated: 2025-03-21 21:31LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.
{
"affected": [],
"aliases": [
"CVE-2023-0796"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-13T23:15:00Z",
"severity": "MODERATE"
},
"details": "LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.",
"id": "GHSA-m222-cmhp-v9m7",
"modified": "2025-03-21T21:31:32Z",
"published": "2023-02-14T00:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0796"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0796.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68"
},
{
"type": "WEB",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/499"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00026.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202305-31"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230316-0003"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5361"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M22H-XR4X-3Q2G
Vulnerability from github – Published: 2022-05-13 01:49 – Updated: 2022-05-13 01:49In libpbc.a in PBC through 2017-03-02, there is a buffer over-read in calc_hash in map.c.
{
"affected": [],
"aliases": [
"CVE-2018-12915"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-27T18:29:00Z",
"severity": "CRITICAL"
},
"details": "In libpbc.a in PBC through 2017-03-02, there is a buffer over-read in calc_hash in map.c.",
"id": "GHSA-m22h-xr4x-3q2g",
"modified": "2022-05-13T01:49:41Z",
"published": "2022-05-13T01:49:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12915"
},
{
"type": "WEB",
"url": "https://github.com/cloudwu/pbc/issues/118"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M24G-Q7XM-F893
Vulnerability from github – Published: 2026-08-11 18:31 – Updated: 2026-08-11 18:31Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.
{
"affected": [],
"aliases": [
"CVE-2026-62703"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T17:18:20Z",
"severity": "MODERATE"
},
"details": "Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.",
"id": "GHSA-m24g-q7xm-f893",
"modified": "2026-08-11T18:31:12Z",
"published": "2026-08-11T18:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62703"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62703"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M264-RXP9-QM6V
Vulnerability from github – Published: 2023-05-10 18:30 – Updated: 2025-11-04 21:30An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulnerability.This vulnerability occurs when no port argument is provided to the PORT command.
{
"affected": [],
"aliases": [
"CVE-2022-46378"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-823"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-10T16:15:10Z",
"severity": "HIGH"
},
"details": "An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulnerability.This vulnerability occurs when no port argument is provided to the `PORT` command.",
"id": "GHSA-m264-rxp9-qm6v",
"modified": "2025-11-04T21:30:33Z",
"published": "2023-05-10T18:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46378"
},
{
"type": "WEB",
"url": "https://github.com/weston-embedded/uC-FTPs/pull/2"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1681"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1681"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M276-429X-F63W
Vulnerability from github – Published: 2026-07-30 06:32 – Updated: 2026-07-30 06:32A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.
{
"affected": [],
"aliases": [
"CVE-2026-16530"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-30T06:25:03Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system\u0027s memory.",
"id": "GHSA-m276-429x-f63w",
"modified": "2026-07-30T06:32:37Z",
"published": "2026-07-30T06:32:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16530"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-16530"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506033"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-M27M-5MQJ-H84F
Vulnerability from github – Published: 2026-09-12 18:30 – Updated: 2026-09-12 18:30Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_unit() when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a crash or limited heap memory exposure when loaded.
{
"affected": [],
"aliases": [
"CVE-2026-90557"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-12T18:16:44Z",
"severity": "MODERATE"
},
"details": "Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_unit() when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a crash or limited heap memory exposure when loaded.",
"id": "GHSA-m27m-5mqj-h84f",
"modified": "2026-09-12T18:30:22Z",
"published": "2026-09-12T18:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90557"
},
{
"type": "WEB",
"url": "https://github.com/freeciv/freeciv/commit/ef0c76c2765fe383140eb1a70dbea1228844152e"
},
{
"type": "WEB",
"url": "https://github.com/freeciv/freeciv"
},
{
"type": "WEB",
"url": "https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame2.c#L4282"
},
{
"type": "WEB",
"url": "https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame3.c#L6108"
},
{
"type": "WEB",
"url": "https://github.com/freeciv/freeciv/releases/tag/R3_2_6"
},
{
"type": "WEB",
"url": "https://redmine.freeciv.org/issues/2162"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/freeciv-3.1.0-through-3.2.5-out-of-bounds-read-via-savegame"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M288-F8H5-GXR4
Vulnerability from github – Published: 2024-04-01 03:30 – Updated: 2024-07-03 18:34In da, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541746; Issue ID: ALPS08541746.
{
"affected": [],
"aliases": [
"CVE-2024-20041"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-01T03:15:07Z",
"severity": "MODERATE"
},
"details": "In da, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541746; Issue ID: ALPS08541746.",
"id": "GHSA-m288-f8h5-gxr4",
"modified": "2024-07-03T18:34:00Z",
"published": "2024-04-01T03:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20041"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/April-2024"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M28F-FMGF-V7CW
Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-09-03 18:31In the Linux kernel, the following vulnerability has been resolved:
usb: misc: usbio: bound bulk IN response length to the received transfer
usbio_bulk_msg() copies bpkt_len = le16_to_cpu(bpkt->len) bytes out of the bulk IN buffer (usbio->rxbuf, allocated with size usbio->rxbuf_len) into the caller's buffer. bpkt_len is fully controlled by the device and is only checked against ibuf_len; ibuf_len in turn is checked against usbio->txbuf_len, not against rxbuf_len:
if ((obuf_len > (usbio->txbuf_len - sizeof(*bpkt))) ||
(ibuf_len > (usbio->txbuf_len - sizeof(*bpkt))))
return -EMSGSIZE;
txbuf_len and rxbuf_len are taken independently from the bulk OUT and bulk IN endpoint wMaxPacketSize in usbio_probe(). A malicious or malfunctioning device that advertises a large bulk OUT endpoint and a small bulk IN endpoint (e.g. by claiming one of the quirk-free IDs such as the Lattice NX33U, 0x2ac1:0x20cb) therefore makes ibuf_len, and hence the device-supplied bpkt_len, exceed rxbuf_len. memcpy() then reads up to txbuf_len - rxbuf_len bytes past the end of the rxbuf slab object. The over-read bytes are handed back to the i2c layer and on to user space through i2c-dev, disclosing adjacent slab memory; with KASAN this is reported as a slab-out-of-bounds read.
The number of bytes actually received is already known: act equals the URB actual_length and is bounded by rxbuf_len. Reject any response that claims more payload than was received, mirroring the existing "act < sizeof(*bpkt)" check just above.
The control path (usbio_ctrl_msg()) is not affected: it uses a single buffer (ctrlbuf) for both directions, so its analogous copy can never leave the allocation.
Found by code review. The out-of-bounds read was confirmed under AddressSanitizer with a faithful userspace model of usbio_bulk_msg()'s receive path (an rxbuf_len-sized buffer, the same act/ibuf_len/bpkt_len checks and the memcpy). A USB raw-gadget + dummy_hcd reproducer is also available.
{
"affected": [],
"aliases": [
"CVE-2026-64339"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-25T10:17:15Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: misc: usbio: bound bulk IN response length to the received transfer\n\nusbio_bulk_msg() copies bpkt_len = le16_to_cpu(bpkt-\u003elen) bytes out of\nthe bulk IN buffer (usbio-\u003erxbuf, allocated with size usbio-\u003erxbuf_len)\ninto the caller\u0027s buffer. bpkt_len is fully controlled by the device\nand is only checked against ibuf_len; ibuf_len in turn is checked\nagainst usbio-\u003etxbuf_len, not against rxbuf_len:\n\n\tif ((obuf_len \u003e (usbio-\u003etxbuf_len - sizeof(*bpkt))) ||\n\t (ibuf_len \u003e (usbio-\u003etxbuf_len - sizeof(*bpkt))))\n\t\treturn -EMSGSIZE;\n\ntxbuf_len and rxbuf_len are taken independently from the bulk OUT and\nbulk IN endpoint wMaxPacketSize in usbio_probe(). A malicious or\nmalfunctioning device that advertises a large bulk OUT endpoint and a\nsmall bulk IN endpoint (e.g. by claiming one of the quirk-free IDs such\nas the Lattice NX33U, 0x2ac1:0x20cb) therefore makes ibuf_len, and\nhence the device-supplied bpkt_len, exceed rxbuf_len. memcpy() then\nreads up to txbuf_len - rxbuf_len bytes past the end of the rxbuf slab\nobject. The over-read bytes are handed back to the i2c layer and on to\nuser space through i2c-dev, disclosing adjacent slab memory; with KASAN\nthis is reported as a slab-out-of-bounds read.\n\nThe number of bytes actually received is already known: act equals the\nURB actual_length and is bounded by rxbuf_len. Reject any response\nthat claims more payload than was received, mirroring the existing\n\"act \u003c sizeof(*bpkt)\" check just above.\n\nThe control path (usbio_ctrl_msg()) is not affected: it uses a single\nbuffer (ctrlbuf) for both directions, so its analogous copy can never\nleave the allocation.\n\nFound by code review. The out-of-bounds read was confirmed under\nAddressSanitizer with a faithful userspace model of usbio_bulk_msg()\u0027s\nreceive path (an rxbuf_len-sized buffer, the same act/ibuf_len/bpkt_len\nchecks and the memcpy). A USB raw-gadget + dummy_hcd reproducer is\nalso available.",
"id": "GHSA-m28f-fmgf-v7cw",
"modified": "2026-09-03T18:31:17Z",
"published": "2026-07-25T12:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64339"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/48394f94211cf8fe0ea8604fc441633abf90fc94"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8c6314489550fa81d41723a0ff33f655b5b6c7b6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fc1b546973c1442d5b947fcdd03581f20ecc5bd2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M28H-7PHP-JRHG
Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-07-20 15:31In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
Fix netfs_read_to_pagecache() so that it pauses the generation of new subrequests if an already-issued subrequest fails.
{
"affected": [],
"aliases": [
"CVE-2026-64066"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T16:17:47Z",
"severity": "CRITICAL"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix netfs_read_to_pagecache() to pause on subreq failure\n\nFix netfs_read_to_pagecache() so that it pauses the generation of new\nsubrequests if an already-issued subrequest fails.",
"id": "GHSA-m28h-7php-jrhg",
"modified": "2026-07-20T15:31:58Z",
"published": "2026-07-19T18:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64066"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0256e79ce42101ad036edd4205bccca621ea0927"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/884c4c4f35e577aba6a0593c80cbea9ca5e6e2b8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.