Common Weakness Enumeration
CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
11503 vulnerabilities reference this CWE, most recent first.
GHSA-7884-JQRX-4H3V
Vulnerability from github – Published: 2024-03-11 21:31 – Updated: 2024-11-23 03:31
VLAI
Details
In acpm_tmu_ipc_handler of tmu_plugin.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-25991"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-11T19:15:47Z",
"severity": "LOW"
},
"details": "In acpm_tmu_ipc_handler of tmu_plugin.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-7884-jqrx-4h3v",
"modified": "2024-11-23T03:31:56Z",
"published": "2024-03-11T21:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25991"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2024-03-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7898-GP2F-5CHR
Vulnerability from github – Published: 2022-05-24 17:21 – Updated: 2022-05-24 17:21
VLAI
Details
Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
{
"affected": [],
"aliases": [
"CVE-2020-9627"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-26T21:15:00Z",
"severity": "MODERATE"
},
"details": "Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.",
"id": "GHSA-7898-gp2f-5chr",
"modified": "2022-05-24T17:21:53Z",
"published": "2022-05-24T17:21:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9627"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/dng-sdk/apsb20-26.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-78F8-4PFR-6R63
Vulnerability from github – Published: 2022-05-24 16:53 – Updated: 2024-04-04 01:41
VLAI
Details
GoPro GPMF-parser 1.2.2 has a heap-based buffer over-read (4 bytes) in GPMF_Next in GPMF_parser.c.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2019-15146"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-18T19:15:00Z",
"severity": "MODERATE"
},
"details": "GoPro GPMF-parser 1.2.2 has a heap-based buffer over-read (4 bytes) in GPMF_Next in GPMF_parser.c.",
"id": "GHSA-78f8-4pfr-6r63",
"modified": "2024-04-04T01:41:57Z",
"published": "2022-05-24T16:53:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15146"
},
{
"type": "WEB",
"url": "https://github.com/gopro/gpmf-parser/issues/60"
},
{
"type": "WEB",
"url": "https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-78FP-H4Q6-QMJG
Vulnerability from github – Published: 2025-04-01 00:30 – Updated: 2025-11-04 00:32
VLAI
Details
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to read files outside of its sandbox.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-30458"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-31T23:15:27Z",
"severity": "CRITICAL"
},
"details": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to read files outside of its sandbox.",
"id": "GHSA-78fp-h4q6-qmjg",
"modified": "2025-11-04T00:32:25Z",
"published": "2025-04-01T00:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30458"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122373"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-78FX-5W4Q-GXW3
Vulnerability from github – Published: 2022-05-17 02:37 – Updated: 2022-05-17 02:37
VLAI
Details
Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote attackers to cause a denial of service (out-of-bounds read, memory leak, and crash) via a crafted image.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2016-6491"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-12-13T15:59:00Z",
"severity": "HIGH"
},
"details": "Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote attackers to cause a denial of service (out-of-bounds read, memory leak, and crash) via a crafted image.",
"id": "GHSA-78fx-5w4q-gxw3",
"modified": "2022-05-17T02:37:29Z",
"published": "2022-05-17T02:37:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6491"
},
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/commit/dd84447b63a71fa8c3f47071b09454efc667767b"
},
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/blob/6.9.5-4/ChangeLog"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201611-21"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/07/28/13"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/07/28/15"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/92186"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1036501"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-78G5-3X26-97JC
Vulnerability from github – Published: 2025-12-08 18:30 – Updated: 2025-12-08 21:30
VLAI
Details
In ProcessArea of dng_misc_opcodes.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-48622"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-08T17:16:18Z",
"severity": "MODERATE"
},
"details": "In ProcessArea of dng_misc_opcodes.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-78g5-3x26-97jc",
"modified": "2025-12-08T21:30:21Z",
"published": "2025-12-08T18:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48622"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/cts/+/1bcf948f5e555ad7b9b54549698c3e569d7a0af5"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/external/dng_sdk/+/de700ad461e35af50b28b861943a0b0753b10929"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/external/skia/+/40c3f0a50fb9b47f543be0949f9004e77510f494"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2025-12-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-78GQ-46GF-2HPP
Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-06-01 18:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
Although it is guided that #mbox-cells must be at least 1, there are
many instances of #mbox-cells = <0>; in the device tree. If that is
the case and the corresponding mailbox controller does not provide
fw_xlate and of_xlatefunction pointers,fw_mbox_index_xlate()` will
be used by default and out-of-bounds accesses could occur due to lack of
bounds check in that function.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2026-43281"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T12:16:49Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()\n\nAlthough it is guided that `#mbox-cells` must be at least 1, there are\nmany instances of `#mbox-cells = \u003c0\u003e;` in the device tree. If that is\nthe case and the corresponding mailbox controller does not provide\n`fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will\nbe used by default and out-of-bounds accesses could occur due to lack of\nbounds check in that function.",
"id": "GHSA-78gq-46gf-2hpp",
"modified": "2026-06-01T18:31:30Z",
"published": "2026-05-06T12:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43281"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2662ed331a69c0b551f78af58f12eb629a89a36f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2c7ff651ec6b660c7c96a36db9328b3232f555d8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/31c4c67dec3362094a6747a171a4848e98542265"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4caae8168d1b808c7d4ff481295292e3f97f90fb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ec0874447895b994182a962d2fee9ef075de5efd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f50b39fd7c72a8734153644ee945ca0d8b2e65ab"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fcd7f96c783626c07ee3ed75fa3739a8a2052310"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-78HG-5FHJ-7WPC
Vulnerability from github – Published: 2024-11-12 21:30 – Updated: 2024-11-12 21:30
VLAI
Details
Illustrator versions 28.7.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-47456"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T19:15:16Z",
"severity": "MODERATE"
},
"details": "Illustrator versions 28.7.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-78hg-5fhj-7wpc",
"modified": "2024-11-12T21:30:53Z",
"published": "2024-11-12T21:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47456"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/illustrator/apsb24-87.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-78HQ-848F-RJWP
Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2025-04-20 03:35
VLAI
Details
The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-7607"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-09T14:59:00Z",
"severity": "MODERATE"
},
"details": "The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
"id": "GHSA-78hq-848f-rjwp",
"modified": "2025-04-20T03:35:38Z",
"published": "2022-05-13T01:47:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7607"
},
{
"type": "WEB",
"url": "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-handle_gnu_hash-readelf-c"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201710-10"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3670-1"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98608"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-78M6-6G3F-HQW3
Vulnerability from github – Published: 2025-02-03 18:30 – Updated: 2025-02-03 18:30
VLAI
Details
Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-38404"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-03T17:15:16Z",
"severity": "HIGH"
},
"details": "Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.",
"id": "GHSA-78m6-6g3f-hqw3",
"modified": "2025-02-03T18:30:41Z",
"published": "2025-02-03T18:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38404"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.