CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
11419 vulnerabilities reference this CWE, most recent first.
GHSA-9PJJ-33MJ-C4QQ
Vulnerability from github – Published: 2022-05-14 03:46 – Updated: 2022-05-14 03:46Irssi before 1.0.5, when installing themes with unterminated colour formatting sequences, may access data beyond the end of the string.
{
"affected": [],
"aliases": [
"CVE-2017-15228"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-10-22T20:29:00Z",
"severity": "HIGH"
},
"details": "Irssi before 1.0.5, when installing themes with unterminated colour formatting sequences, may access data beyond the end of the string.",
"id": "GHSA-9pjj-33mj-c4qq",
"modified": "2022-05-14T03:46:35Z",
"published": "2022-05-14T03:46:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15228"
},
{
"type": "WEB",
"url": "https://irssi.org/security/irssi_sa_2017_10.txt"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00022.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2017/dsa-4016"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2017/10/22/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9PJQ-CF4Q-JRQH
Vulnerability from github – Published: 2025-07-21 21:31 – Updated: 2025-07-21 21:31IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26213.
{
"affected": [],
"aliases": [
"CVE-2025-7279"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-21T20:15:49Z",
"severity": "HIGH"
},
"details": "IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26213.",
"id": "GHSA-9pjq-cf4q-jrqh",
"modified": "2025-07-21T21:31:40Z",
"published": "2025-07-21T21:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7279"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-527"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9PMQ-32G5-2H85
Vulnerability from github – Published: 2022-05-14 02:20 – Updated: 2022-05-14 02:20A parameter verification issue was discovered in Xen through 4.9.x. The function alloc_heap_pages allows callers to specify the first NUMA node that should be used for allocations through the memflags parameter; the node is extracted using the MEMF_get_node macro. While the function checks to see if the special constant NUMA_NO_NODE is specified, it otherwise does not handle the case where node >= MAX_NUMNODES. This allows an out-of-bounds access to an internal array.
{
"affected": [],
"aliases": [
"CVE-2017-14316"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-12T15:29:00Z",
"severity": "HIGH"
},
"details": "A parameter verification issue was discovered in Xen through 4.9.x. The function `alloc_heap_pages` allows callers to specify the first NUMA node that should be used for allocations through the `memflags` parameter; the node is extracted using the `MEMF_get_node` macro. While the function checks to see if the special constant `NUMA_NO_NODE` is specified, it otherwise does not handle the case where `node \u003e= MAX_NUMNODES`. This allows an out-of-bounds access to an internal array.",
"id": "GHSA-9pmq-32g5-2h85",
"modified": "2022-05-14T02:20:30Z",
"published": "2022-05-14T02:20:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14316"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html"
},
{
"type": "WEB",
"url": "https://support.citrix.com/article/CTX227185"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2017/dsa-4050"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100818"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039348"
},
{
"type": "WEB",
"url": "http://xenbits.xen.org/xsa/advisory-231.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9PPJ-8P5H-JG89
Vulnerability from github – Published: 2026-07-08 09:31 – Updated: 2026-07-08 09:31During the process of page opening and form formatting, a JavaScript reentrancy results in an inconsistent document status. Subsequently, with outdated page information, the application attempts to access invalid addresses, causing the application to crash.
{
"affected": [],
"aliases": [
"CVE-2026-57243"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-08T09:16:32Z",
"severity": "MODERATE"
},
"details": "During the process of page opening and form formatting, a JavaScript reentrancy results in an inconsistent document status. Subsequently, with outdated page information, the application attempts to access invalid addresses, causing the application to crash.",
"id": "GHSA-9ppj-8p5h-jg89",
"modified": "2026-07-08T09:31:51Z",
"published": "2026-07-08T09:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57243"
},
{
"type": "WEB",
"url": "https://www.foxit.com/support/security-bulletins.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9PQV-7H63-32CR
Vulnerability from github – Published: 2025-09-05 18:31 – Updated: 2026-07-14 15:31In the Linux kernel, the following vulnerability has been resolved:
net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
Syzbot reported shift-out-of-bounds exception on MDIO bus initialization.
The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations.
Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range.
{
"affected": [],
"aliases": [
"CVE-2025-38736"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-05T18:15:42Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: asix_devices: Fix PHY address mask in MDIO bus initialization\n\nSyzbot reported shift-out-of-bounds exception on MDIO bus initialization.\n\nThe PHY address should be masked to 5 bits (0-31). Without this\nmask, invalid PHY addresses could be used, potentially causing issues\nwith MDIO bus operations.\n\nFix this by masking the PHY address with 0x1f (31 decimal) to ensure\nit stays within the valid range.",
"id": "GHSA-9pqv-7h63-32cr",
"modified": "2026-07-14T15:31:27Z",
"published": "2025-09-05T18:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38736"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/22042ffedd8c2c6db08ccdd6d4273068eddd3c5c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/24ef2f53c07f273bad99173e27ee88d44d135b1c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/523eab02fce458fa6d3c51de5bb055800986953e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/748da80831221ae24b4bc8d7ffb22acd5712a341"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8f141f2a4f2ef8ca865d5921574c3d6535e00a49"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fcb4ce9f729c1d08e53abf9d449340e24c3edee6"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9PVF-CRWC-VR62
Vulnerability from github – Published: 2023-04-11 21:31 – Updated: 2023-04-11 21:31Microsoft Message Queuing Denial of Service Vulnerability
{
"affected": [],
"aliases": [
"CVE-2023-21769"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-11T21:15:00Z",
"severity": "HIGH"
},
"details": "Microsoft Message Queuing Denial of Service Vulnerability",
"id": "GHSA-9pvf-crwc-vr62",
"modified": "2023-04-11T21:31:02Z",
"published": "2023-04-11T21:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21769"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21769"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9Q3J-RXJ9-3656
Vulnerability from github – Published: 2026-05-06 21:31 – Updated: 2026-05-07 01:05Out of bounds read in Dawn in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2026-7983"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T19:16:49Z",
"severity": "MODERATE"
},
"details": "Out of bounds read in Dawn in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-9q3j-rxj9-3656",
"modified": "2026-05-07T01:05:53Z",
"published": "2026-05-06T21:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7983"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/497975608"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9Q64-8G8H-WR27
Vulnerability from github – Published: 2022-01-22 00:00 – Updated: 2026-01-08 12:30Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.97 and prior and ICONICS Hyper Historian versions 10.97 and prior allows an attacker to cause a DoS condition in the database server by getting a legitimate user to import a configuration file containing specially crafted stored procedures into GENESIS64 or MC Works64 and execute commands against the database from GENESIS64 or MC Works64.
{
"affected": [],
"aliases": [
"CVE-2022-23130"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-21T19:15:00Z",
"severity": "MODERATE"
},
"details": "Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.97 and prior and ICONICS Hyper Historian versions 10.97 and prior allows an attacker to cause a DoS condition in the database server by getting a legitimate user to import a configuration file containing specially crafted stored procedures into GENESIS64 or MC Works64 and execute commands against the database from GENESIS64 or MC Works64.",
"id": "GHSA-9q64-8g8h-wr27",
"modified": "2026-01-08T12:30:28Z",
"published": "2022-01-22T00:00:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23130"
},
{
"type": "WEB",
"url": "https://jvn.jp/vu/JVNVU95403720/index.html"
},
{
"type": "WEB",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-020-01"
},
{
"type": "WEB",
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-028_en.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9Q78-27F3-2JMH
Vulnerability from github – Published: 2025-08-29 20:30 – Updated: 2025-08-29 20:30Affected versions of this crate did not check that the input slice passed to "webp::Encoder::encode() is large enough for the specified image dimensions.
If the input slice is too short, the library will read out of bounds of the buffer and encode other memory contents as an image, resulting in memory exposure or a segmentation fault.
The flaw was corrected in pull request #44 by always validating the input buffer size when constructing the encoder.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "webp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-29T20:30:04Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Affected versions of this crate did not check that the input slice passed to `\"webp::Encoder::encode()` is large enough for the specified image dimensions.\n\nIf the input slice is too short, the library will read out of bounds of the buffer and encode other memory contents as an image, resulting in memory exposure or a segmentation fault.\n\nThe flaw was corrected in [pull request #44](https://github.com/jaredforth/webp/pull/44) by always validating the input buffer size when constructing the encoder.",
"id": "GHSA-9q78-27f3-2jmh",
"modified": "2025-08-29T20:30:04Z",
"published": "2025-08-29T20:30:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jaredforth/webp/issues/40"
},
{
"type": "WEB",
"url": "https://github.com/jaredforth/webp/pull/44"
},
{
"type": "WEB",
"url": "https://github.com/jaredforth/webp/commit/62b47060d7fb8cc0e92e522ee54948edf5aab556"
},
{
"type": "PACKAGE",
"url": "https://github.com/jaredforth/webp"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2024-0443.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "webp crate may expose memory contents when encoding an image"
}
GHSA-9Q8F-8CCC-G96C
Vulnerability from github – Published: 2022-05-24 19:04 – Updated: 2022-05-24 19:04Out of bounds read in V8 in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page.
{
"affected": [],
"aliases": [
"CVE-2021-30536"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-07T20:15:00Z",
"severity": "HIGH"
},
"details": "Out of bounds read in V8 in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page.",
"id": "GHSA-9q8f-8ccc-g96c",
"modified": "2022-05-24T19:04:10Z",
"published": "2022-05-24T19:04:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30536"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1194358"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202107-06"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.