Common Weakness Enumeration
CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
11265 vulnerabilities reference this CWE, most recent first.
GHSA-JR7J-3VJJ-9C7J
Vulnerability from github – Published: 2024-11-17 06:30 – Updated: 2024-11-18 18:30
VLAI
Details
Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions (in broadcast mode) via multiple read operations on the ASTM Remote ID (0xFFFA) GATT.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-52876"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-17T05:15:04Z",
"severity": "HIGH"
},
"details": "Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated \"remote power off\" actions (in broadcast mode) via multiple read operations on the ASTM Remote ID (0xFFFA) GATT.",
"id": "GHSA-jr7j-3vjj-9c7j",
"modified": "2024-11-18T18:30:54Z",
"published": "2024-11-17T06:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52876"
},
{
"type": "WEB",
"url": "https://coalfire.com/the-coalfire-blog/holy-stone-remote-id-vulnerability-disclosure"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JR8Q-JW7M-4M3M
Vulnerability from github – Published: 2022-05-13 01:03 – Updated: 2022-05-13 01:03
VLAI
Details
An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.
Severity
{
"affected": [],
"aliases": [
"CVE-2018-16866"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-200"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-11T19:29:00Z",
"severity": "LOW"
},
"details": "An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon \u0027:\u0027. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.",
"id": "GHSA-jr8q-jw7m-4m3m",
"modified": "2022-05-13T01:03:33Z",
"published": "2022-05-13T01:03:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16866"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2020:0547"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2091"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3222"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0593"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:1264"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2018-16866"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1653867"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16866"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/May/25"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201903-07"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190117-0001"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3855-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4367"
},
{
"type": "WEB",
"url": "https://www.qualys.com/2019/01/09/system-down/system-down.txt"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2019/May/21"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/05/10/4"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106527"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JR9J-FPM4-635P
Vulnerability from github – Published: 2022-05-12 00:00 – Updated: 2022-05-12 00:00
VLAI
Details
Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-28264"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-11T18:15:00Z",
"severity": "MODERATE"
},
"details": "Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-jr9j-fpm4-635p",
"modified": "2022-05-12T00:00:55Z",
"published": "2022-05-12T00:00:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28264"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/acrobat/apsb22-16.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JR9W-7878-CFM9
Vulnerability from github – Published: 2022-05-24 19:16 – Updated: 2022-05-24 19:16
VLAI
Details
Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.
{
"affected": [],
"aliases": [
"CVE-2021-39833"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-29T16:15:00Z",
"severity": "LOW"
},
"details": "Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.",
"id": "GHSA-jr9w-7878-cfm9",
"modified": "2022-05-24T19:16:06Z",
"published": "2022-05-24T19:16:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39833"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/framemaker/apsb21-74.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JRC8-CM2R-WC39
Vulnerability from github – Published: 2022-05-17 02:52 – Updated: 2022-05-17 02:52
VLAI
Details
The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds read) via a crafted plist file.
Severity
5.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-6437"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-15T14:59:00Z",
"severity": "MODERATE"
},
"details": "The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds read) via a crafted plist file.",
"id": "GHSA-jrc8-cm2r-wc39",
"modified": "2022-05-17T02:52:21Z",
"published": "2022-05-17T02:52:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6437"
},
{
"type": "WEB",
"url": "https://github.com/libimobiledevice/libplist/issues/100"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97291"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JRCM-4657-67WP
Vulnerability from github – Published: 2022-05-17 03:38 – Updated: 2022-05-17 03:38
VLAI
Details
Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbitrary code via a crafted BMP image embedded in the XFA stream in a PDF document, aka "Data from Faulting Address may be used as a return value starting at FOXITREADER."
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2016-8878"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-10-31T10:59:00Z",
"severity": "HIGH"
},
"details": "Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbitrary code via a crafted BMP image embedded in the XFA stream in a PDF document, aka \"Data from Faulting Address may be used as a return value starting at FOXITREADER.\"",
"id": "GHSA-jrcm-4657-67wp",
"modified": "2022-05-17T03:38:27Z",
"published": "2022-05-17T03:38:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8878"
},
{
"type": "WEB",
"url": "https://www.foxitsoftware.com/support/security-bulletins.php"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93608"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JRCR-MFPR-RGG9
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2022-05-13 01:25
VLAI
Details
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2018-18313"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-07T21:29:00Z",
"severity": "CRITICAL"
},
"details": "Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.",
"id": "GHSA-jrcr-mfpr-rgg9",
"modified": "2022-05-13T01:25:18Z",
"published": "2022-05-13T01:25:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18313"
},
{
"type": "WEB",
"url": "https://github.com/Perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:0001"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:0010"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1646738"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM"
},
{
"type": "WEB",
"url": "https://metacpan.org/changes/release/SHAY/perl-5.26.3"
},
{
"type": "WEB",
"url": "https://rt.perl.org/Ticket/Display.html?id=133192"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Mar/42"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201909-01"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190221-0003"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT209600"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3834-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3834-2"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4347"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2019/Mar/49"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1042181"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JRH2-F82P-H3MV
Vulnerability from github – Published: 2022-05-24 19:08 – Updated: 2022-05-24 19:08
VLAI
Details
An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact due to an invalid memory read.
{
"affected": [],
"aliases": [
"CVE-2020-19499"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-21T18:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact due to an invalid memory read.",
"id": "GHSA-jrh2-f82p-h3mv",
"modified": "2022-05-24T19:08:32Z",
"published": "2022-05-24T19:08:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19499"
},
{
"type": "WEB",
"url": "https://github.com/strukturag/libheif/issues/138"
},
{
"type": "WEB",
"url": "https://github.com/strukturag/libheif/commit/f7399b62d7fbc596f1b2871578c1d2053bedf1dd"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JRHG-66XP-FMHV
Vulnerability from github – Published: 2024-11-15 18:30 – Updated: 2024-11-15 18:30
VLAI
Details
A vulnerability in Cisco TelePresence CE and RoomOS could allow an unauthenticated, adjacent attacker to view sensitive information on an affected device.
This vulnerability exists because the affected software performs improper bounds checks. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read that discloses sensitive information. Note: This vulnerability only affects Cisco Webex Desk Hub. There are no workarounds that address this vulnerability.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-20094"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-15T16:15:26Z",
"severity": "MODERATE"
},
"details": "A vulnerability in Cisco TelePresence CE and RoomOS could allow an unauthenticated, adjacent attacker to view sensitive information on an affected device.\n\nThis vulnerability exists because the affected software performs improper bounds checks. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read that discloses sensitive information.\nNote: This vulnerability only affects Cisco Webex Desk Hub.\nThere are no workarounds that address this vulnerability.",
"id": "GHSA-jrhg-66xp-fmhv",
"modified": "2024-11-15T18:30:50Z",
"published": "2024-11-15T18:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20094"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-file-write-rHKwegKf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JRPG-G4VF-P4HW
Vulnerability from github – Published: 2025-09-11 18:35 – Updated: 2026-05-12 15:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Validate UAC3 cluster segment descriptors
UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2025-39757"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-11T17:15:39Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Validate UAC3 cluster segment descriptors\n\nUAC3 class segment descriptors need to be verified whether their sizes\nmatch with the declared lengths and whether they fit with the\nallocated buffer sizes, too. Otherwise malicious firmware may lead to\nthe unexpected OOB accesses.",
"id": "GHSA-jrpg-g4vf-p4hw",
"modified": "2026-05-12T15:31:06Z",
"published": "2025-09-11T18:35:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39757"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1034719fdefd26caeec0a44a868bb5a412c2c1a5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/275e37532e8ebe25e8a4069b2d9f955bfd202a46"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/47ab3d820cb0a502bd0074f83bb3cf7ab5d79902"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/786571b10b1ae6d90e1242848ce78ee7e1d493c4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/799c06ad4c9c790c265e8b6b94947213f1fb389c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7ef3fd250f84494fb2f7871f357808edaa1fc6ce"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ae17b3b5e753efc239421d186cd1ff06e5ac296e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dfdcbcde5c20df878178245d4449feada7d5b201"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ecfd41166b72b67d3bdeb88d224ff445f6163869"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.