CWE-124
AllowedBuffer Underwrite ('Buffer Underflow')
Abstraction: Base · Status: Incomplete
The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
71 vulnerabilities reference this CWE, most recent first.
GHSA-45FH-4474-XC77
Vulnerability from github – Published: 2026-05-15 15:30 – Updated: 2026-06-30 03:36A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in remote.c. This vulnerability occurs in the remote control functionality when processing malformed input, leading to a stack buffer underflow that can cause application crashes and potentially allow code execution.
{
"affected": [],
"aliases": [
"CVE-2026-34253"
],
"database_specific": {
"cwe_ids": [
"CWE-124"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-15T15:16:51Z",
"severity": "HIGH"
},
"details": "A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in remote.c. This vulnerability occurs in the remote control functionality when processing malformed input, leading to a stack buffer underflow that can cause application crashes and potentially allow code execution.",
"id": "GHSA-45fh-4474-xc77",
"modified": "2026-06-30T03:36:43Z",
"published": "2026-05-15T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34253"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-34253"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477925"
},
{
"type": "WEB",
"url": "https://github.com/xiph/vorbis-tools/archive/refs/tags/v1.4.3.tar.gz"
},
{
"type": "WEB",
"url": "https://github.com/xiph/vorbis-tools/blob/0b3fbf42eb3897d32f4a75baa2dc915a4ca45e8e/ogg123/remote.c#L153"
},
{
"type": "WEB",
"url": "https://gitlab.xiph.org/xiph/vorbis-tools/-/work_items/2332"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34253.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-48CG-HM45-PP65
Vulnerability from github – Published: 2025-03-11 18:32 – Updated: 2025-03-11 18:32Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
{
"affected": [],
"aliases": [
"CVE-2025-27439"
],
"database_specific": {
"cwe_ids": [
"CWE-124"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-11T18:15:36Z",
"severity": "HIGH"
},
"details": "Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.",
"id": "GHSA-48cg-hm45-pp65",
"modified": "2025-03-11T18:32:21Z",
"published": "2025-03-11T18:32:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27439"
},
{
"type": "WEB",
"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25011"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4CR7-R8F8-3J39
Vulnerability from github – Published: 2023-09-25 18:30 – Updated: 2025-11-04 21:30A heap-based buffer overflow vulnerability exists in the create_png_object functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2023-32614"
],
"database_specific": {
"cwe_ids": [
"CWE-124",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-25T16:15:13Z",
"severity": "CRITICAL"
},
"details": "A heap-based buffer overflow vulnerability exists in the create_png_object functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.",
"id": "GHSA-4cr7-r8f8-3j39",
"modified": "2025-11-04T21:30:39Z",
"published": "2023-09-25T18:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32614"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1749"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1749"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-4P4H-XVFF-9P66
Vulnerability from github – Published: 2022-04-16 00:00 – Updated: 2022-04-27 00:00A vulnerability in the Application Visibility and Control (AVC-FNF) feature of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient packet verification for traffic inspected by the AVC feature. An attacker could exploit this vulnerability by sending crafted packets from the wired network to a wireless client, resulting in the crafted packets being processed by the wireless controller. A successful exploit could allow the attacker to cause a crash and reload of the affected device, resulting in a DoS condition.
{
"affected": [],
"aliases": [
"CVE-2022-20683"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-124",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-15T15:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the Application Visibility and Control (AVC-FNF) feature of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient packet verification for traffic inspected by the AVC feature. An attacker could exploit this vulnerability by sending crafted packets from the wired network to a wireless client, resulting in the crafted packets being processed by the wireless controller. A successful exploit could allow the attacker to cause a crash and reload of the affected device, resulting in a DoS condition.",
"id": "GHSA-4p4h-xvff-9p66",
"modified": "2022-04-27T00:00:34Z",
"published": "2022-04-16T00:00:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20683"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-fnf-dos-bOL5vLge"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-542W-VQGJ-322R
Vulnerability from github – Published: 2025-03-11 18:32 – Updated: 2025-03-11 18:32Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
{
"affected": [],
"aliases": [
"CVE-2025-27440"
],
"database_specific": {
"cwe_ids": [
"CWE-124"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-11T18:15:36Z",
"severity": "HIGH"
},
"details": "Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.",
"id": "GHSA-542w-vqgj-322r",
"modified": "2025-03-11T18:32:21Z",
"published": "2025-03-11T18:32:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27440"
},
{
"type": "WEB",
"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25011"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5CCP-7J7J-GHRV
Vulnerability from github – Published: 2025-07-08 03:31 – Updated: 2025-07-08 15:32In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09752821; Issue ID: MSV-3342.
{
"affected": [],
"aliases": [
"CVE-2025-20694"
],
"database_specific": {
"cwe_ids": [
"CWE-124"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-08T03:15:29Z",
"severity": "HIGH"
},
"details": "In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09752821; Issue ID: MSV-3342.",
"id": "GHSA-5ccp-7j7j-ghrv",
"modified": "2025-07-08T15:32:02Z",
"published": "2025-07-08T03:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20694"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/July-2025"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5JFW-35XP-5M42
Vulnerability from github – Published: 2022-04-05 17:53 – Updated: 2022-04-05 17:53Impact
LoginPacket uses BinaryStream->getLInt() to read the lengths of JSON payloads it wants to decode. Unfortunately, BinaryStream->getLInt() returns a signed integer, meaning that a malicious client can craft a packet with a large uint32 value for payload buffer size (which would be interpreted as a negative signed int32), causing BinaryStream->get() to throw an exception.
In the context of PocketMine-MP, this leads to a server crash when the vulnerability is exploited.
Patches
e3fce7632b94e83fd6a518a87dcaf6a11681c4ac
Workarounds
This can be worked around by registering a custom LoginPacket implementation into PacketPool which overrides this code to patch it.
For more information
- Email us at team@pmmp.io
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pocketmine/bedrock-protocol"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-124"
],
"github_reviewed": true,
"github_reviewed_at": "2022-04-05T17:53:22Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\n`LoginPacket` uses `BinaryStream-\u003egetLInt()` to read the lengths of JSON payloads it wants to decode. Unfortunately, `BinaryStream-\u003egetLInt()` returns a signed integer, meaning that a malicious client can craft a packet with a large uint32 value for payload buffer size (which would be interpreted as a negative signed int32), causing `BinaryStream-\u003eget()` to throw an exception.\n\nIn the context of PocketMine-MP, this leads to a server crash when the vulnerability is exploited.\n\n### Patches\ne3fce7632b94e83fd6a518a87dcaf6a11681c4ac\n\n### Workarounds\nThis can be worked around by registering a custom `LoginPacket` implementation into `PacketPool` which overrides [this code](https://github.com/pmmp/BedrockProtocol/blob/47532c95ea37d5f0365b23f734d70d943ff95295/src/LoginPacket.php#L54) to patch it.\n\n### For more information\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)",
"id": "GHSA-5jfw-35xp-5m42",
"modified": "2022-04-05T17:53:22Z",
"published": "2022-04-05T17:53:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pmmp/BedrockProtocol/security/advisories/GHSA-5jfw-35xp-5m42"
},
{
"type": "WEB",
"url": "https://github.com/pmmp/BedrockProtocol/commit/e3fce7632b94e83fd6a518a87dcaf6a11681c4ac"
},
{
"type": "PACKAGE",
"url": "https://github.com/pmmp/BedrockProtocol"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown"
}
GHSA-5W34-Q6XM-8G89
Vulnerability from github – Published: 2022-05-24 19:12 – Updated: 2025-11-03 21:30XMP Toolkit version 2020.1 (and earlier) is affected by a Buffer Underflow vulnerability which could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2021-36064"
],
"database_specific": {
"cwe_ids": [
"CWE-124"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-01T15:15:00Z",
"severity": "HIGH"
},
"details": "XMP Toolkit version 2020.1 (and earlier) is affected by a Buffer Underflow vulnerability which could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-5w34-q6xm-8g89",
"modified": "2025-11-03T21:30:33Z",
"published": "2022-05-24T19:12:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36064"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/xmpcore/apsb21-65.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00032.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00003.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-69GV-6PJJ-726F
Vulnerability from github – Published: 2025-07-08 03:31 – Updated: 2025-07-08 15:32In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09741871; Issue ID: MSV-3317.
{
"affected": [],
"aliases": [
"CVE-2025-20695"
],
"database_specific": {
"cwe_ids": [
"CWE-124",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-08T03:15:29Z",
"severity": "HIGH"
},
"details": "In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09741871; Issue ID: MSV-3317.",
"id": "GHSA-69gv-6pjj-726f",
"modified": "2025-07-08T15:32:02Z",
"published": "2025-07-08T03:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20695"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/July-2025"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7CJM-MV56-4MG4
Vulnerability from github – Published: 2021-12-02 00:00 – Updated: 2025-11-03 21:30NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.
{
"affected": [],
"aliases": [
"CVE-2021-38575"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-124"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-01T18:15:00Z",
"severity": "CRITICAL"
},
"details": "NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.",
"id": "GHSA-7cjm-mv56-4mg4",
"modified": "2025-11-03T21:30:36Z",
"published": "2021-12-02T00:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38575"
},
{
"type": "WEB",
"url": "https://bugzilla.tianocore.org/show_bug.cgi?id=3356"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html"
},
{
"type": "WEB",
"url": "https://www.insyde.com/security-pledge/SA-2023025"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Choose a language that is not susceptible to these issues.
Mitigation
All calculated values that are used as index or for pointer arithmetic should be validated to ensure that they are within an expected range.
No CAPEC attack patterns related to this CWE.