Common Weakness Enumeration

CWE-125

Allowed

Out-of-bounds Read

Abstraction: Base · Status: Draft

The product reads data past the end, or before the beginning, of the intended buffer.

11542 vulnerabilities reference this CWE, most recent first.

GHSA-6XMX-H98X-6VXG

Vulnerability from github – Published: 2022-05-24 17:47 – Updated: 2022-05-24 17:47
VLAI
Details

XML External Entity Resolution (XXE) in Helix ALM. The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE attacks.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2021-29997"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125",
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-04-13T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "XML External Entity Resolution (XXE) in Helix ALM. The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE attacks.",
  "id": "GHSA-6xmx-h98x-6vxg",
  "modified": "2022-05-24T17:47:29Z",
  "published": "2022-05-24T17:47:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29997"
    },
    {
      "type": "WEB",
      "url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2021-29997"
    },
    {
      "type": "WEB",
      "url": "https://support2.windriver.com/index.php?page=security-notices"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-6XR9-PVGC-M3PC

Vulnerability from github – Published: 2025-02-27 03:34 – Updated: 2025-03-05 21:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

usbnet: ipheth: fix possible overflow in DPE length check

Originally, it was possible for the DPE length check to overflow if wDatagramIndex + wDatagramLength > U16_MAX. This could lead to an OoB read.

Move the wDatagramIndex term to the other side of the inequality.

An existing condition ensures that wDatagramIndex < urb->actual_length.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2025-21743"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-27T03:15:14Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: ipheth: fix possible overflow in DPE length check\n\nOriginally, it was possible for the DPE length check to overflow if\nwDatagramIndex + wDatagramLength \u003e U16_MAX. This could lead to an OoB\nread.\n\nMove the wDatagramIndex term to the other side of the inequality.\n\nAn existing condition ensures that wDatagramIndex \u003c urb-\u003eactual_length.",
  "id": "GHSA-6xr9-pvgc-m3pc",
  "modified": "2025-03-05T21:32:05Z",
  "published": "2025-02-27T03:34:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21743"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/18bf6f5cce3172cb303c3f0551aa9443d5ed74f8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c219427ed296f94bb4b91d08626776dc7719ee27"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d677e7dd59ad6837496f5a02d8e5d39824278dfd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d824a964185910e317287f034c0a439c08b4fe49"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6XRG-QXJF-3XGP

Vulnerability from github – Published: 2024-05-03 03:30 – Updated: 2024-05-03 03:30
VLAI
Details

PDF-XChange Editor OXPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OXPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-20036.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2023-39503"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T03:15:18Z",
    "severity": "LOW"
  },
  "details": "PDF-XChange Editor OXPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OXPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-20036.",
  "id": "GHSA-6xrg-qxjf-3xgp",
  "modified": "2024-05-03T03:30:58Z",
  "published": "2024-05-03T03:30:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39503"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1137"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6XVP-P7QR-FXVH

Vulnerability from github – Published: 2022-05-24 16:55 – Updated: 2023-02-04 00:30
VLAI
Details

Symonics libmysofa 0.7 has an invalid read in getDimension in hrtf/reader.c.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2019-16095"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-09-08T03:15:00Z",
    "severity": "HIGH"
  },
  "details": "Symonics libmysofa 0.7 has an invalid read in getDimension in hrtf/reader.c.",
  "id": "GHSA-6xvp-p7qr-fxvh",
  "modified": "2023-02-04T00:30:37Z",
  "published": "2022-05-24T16:55:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16095"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hoene/libmysofa/compare/f571522...e07edb3"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4473-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6XW4-2G22-26H8

Vulnerability from github – Published: 2026-06-30 18:46 – Updated: 2026-06-30 18:46
VLAI
Summary
Open Babel has an out-of-bounds read in CIF transform3d::DescribeAsString
Details

Summary

A memory-safety vulnerability in Open Babel's CIF file format parser allowed an out-of-bounds read when reading a crafted input file.

Details

The flaw was in OpenBabel::transform3d::DescribeAsString. A malformed symmetry-operation string caused the parser to read past the end of its internal buffer while formatting the description.

Impact

Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious CIF file with the obabel tool, the OBConversion API, or any of the language bindings.

Affected versions

All releases up to and including 3.1.1.

Patched version

3.2.0 (released 2026-05-26).

Patch

Fix commit: https://github.com/openbabel/openbabel/commit/e23a224b Tracked in #2862.

A minimized reproducer for this CVE is checked in at test/files/fuzz_regress/cve-2026-2704.cif and is exercised on every CI build under ASAN+UBSAN by the fuzzregresstest harness.

Credit

Reported by Vedant Madane (@VedantMadane).

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "openbabel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-2704"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119",
      "CWE-125"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-30T18:46:12Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "\u003e ### Summary\n\u003e\n\u003e A memory-safety vulnerability in Open Babel\u0027s CIF file format parser\n\u003e allowed an out-of-bounds read when reading a crafted input file.\n\u003e\n\u003e ### Details\n\u003e\n\u003e The flaw was in `OpenBabel::transform3d::DescribeAsString`. A malformed\n\u003e symmetry-operation string caused the parser to read past the end of its\n\u003e internal buffer while formatting the description.\n\u003e\n\u003e ### Impact\n\u003e\n\u003e Open Babel is a C++ library and CLI used to read and write chemistry\n\u003e file formats; it is shipped by Linux distributions and embedded in\n\u003e services that may parse untrusted input. Triggering this vulnerability\n\u003e requires the victim to open a malicious CIF file with the `obabel`\n\u003e tool, the OBConversion API, or any of the language bindings.\n\u003e\n\u003e ### Affected versions\n\u003e\n\u003e All releases up to and including 3.1.1.\n\u003e\n\u003e ### Patched version\n\u003e\n\u003e 3.2.0 (released 2026-05-26).\n\u003e\n\u003e ### Patch\n\u003e\n\u003e Fix commit: https://github.com/openbabel/openbabel/commit/e23a224b\n\u003e Tracked in #2862.\n\u003e\n\u003e A minimized reproducer for this CVE is checked in at\n\u003e `test/files/fuzz_regress/cve-2026-2704.cif` and is exercised on every\n\u003e CI build under ASAN+UBSAN by the `fuzzregresstest` harness.\n\u003e\n\u003e ### Credit\n\u003e\n\u003e Reported by Vedant Madane (@VedantMadane).",
  "id": "GHSA-6xw4-2g22-26h8",
  "modified": "2026-06-30T18:46:12Z",
  "published": "2026-06-30T18:46:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openbabel/openbabel/security/advisories/GHSA-6xw4-2g22-26h8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2704"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbabel/openbabel/issues/2848"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbabel/openbabel/pull/2862"
    },
    {
      "type": "WEB",
      "url": "https://github.com/VedantMadane/openbabel/commit/e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oneafter/0128/blob/main/ob1/repro.cif"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openbabel/openbabel"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbabel/openbabel/releases/tag/openbabel-3-2-0"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.346650"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.346650"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.754378"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/754378"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/346650"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/346650/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Open Babel has an out-of-bounds read in CIF transform3d::DescribeAsString"
}

GHSA-6XW6-4HXH-3V2W

Vulnerability from github – Published: 2022-05-24 17:48 – Updated: 2022-05-24 17:48
VLAI
Details

A vulnerability has been identified in Nucleus 4 (All versions < V4.1.0), Nucleus NET (All versions), Nucleus RTOS (versions including affected DNS modules), Nucleus ReadyStart (All versions < V2017.02.3), Nucleus Source Code (versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), VSTAR (versions including affected DNS modules). The DNS domain name label parsing functionality does not properly validate the null-terminated name in DNS-responses. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the read memory.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2020-27736"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125",
      "CWE-170",
      "CWE-193"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-04-22T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been identified in Nucleus 4 (All versions \u003c V4.1.0), Nucleus NET (All versions), Nucleus RTOS (versions including affected DNS modules), Nucleus ReadyStart (All versions \u003c V2017.02.3), Nucleus Source Code (versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions \u003c V0.5.0.0), VSTAR (versions including affected DNS modules). The DNS domain name label parsing functionality does not properly validate the null-terminated name in DNS-responses. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the read memory.",
  "id": "GHSA-6xw6-4hxh-3v2w",
  "modified": "2022-05-24T17:48:18Z",
  "published": "2022-05-24T17:48:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27736"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6XWP-952X-4VGF

Vulnerability from github – Published: 2026-04-09 00:32 – Updated: 2026-04-13 21:30
VLAI
Details

Out of bounds read in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-5913"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-08T22:16:31Z",
    "severity": "HIGH"
  },
  "details": "Out of bounds read in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)",
  "id": "GHSA-6xwp-952x-4vgf",
  "modified": "2026-04-13T21:30:39Z",
  "published": "2026-04-09T00:32:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5913"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/487195286"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6XX4-RHCP-HFHM

Vulnerability from github – Published: 2022-05-14 03:39 – Updated: 2022-05-14 03:39
VLAI
Details

The cbstream.sys driver in Carbon Black 5.1.1.60603 allows local users with admin privileges to cause a denial of service (out-of-bounds read and system crash) via a large counter value in an 0x62430028 IOCTL call.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2016-9569"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-02-12T18:29:00Z",
    "severity": "MODERATE"
  },
  "details": "The cbstream.sys driver in Carbon Black 5.1.1.60603 allows local users with admin privileges to cause a denial of service (out-of-bounds read and system crash) via a large counter value in an 0x62430028 IOCTL call.",
  "id": "GHSA-6xx4-rhcp-hfhm",
  "modified": "2022-05-14T03:39:45Z",
  "published": "2022-05-14T03:39:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9569"
    },
    {
      "type": "WEB",
      "url": "https://labs.nettitude.com/blog/carbon-black-security-advisories-cve-2016-9570-cve-2016-9568-and-cve-2016-9569"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7224-W4V6-8R9W

Vulnerability from github – Published: 2023-07-12 18:30 – Updated: 2024-04-04 06:04
VLAI
Details

Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2023-29311"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-12T16:15:12Z",
    "severity": "MODERATE"
  },
  "details": "Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
  "id": "GHSA-7224-w4v6-8r9w",
  "modified": "2024-04-04T06:04:43Z",
  "published": "2023-07-12T18:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29311"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/indesign/apsb23-38.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7226-C5Q3-MC6P

Vulnerability from github – Published: 2026-07-30 18:31 – Updated: 2026-08-05 21:31
VLAI
Details

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-12996"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-30T17:16:28Z",
    "severity": "MODERATE"
  },
  "details": "A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry",
  "id": "GHSA-7226-c5q3-mc6p",
  "modified": "2026-08-05T21:31:31Z",
  "published": "2026-07-30T18:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12996"
    },
    {
      "type": "WEB",
      "url": "https://community.openvpn.net/ReleaseHistory#openvpn-2621-released-1-july-2026"
    },
    {
      "type": "WEB",
      "url": "https://community.openvpn.net/ReleaseHistory#openvpn-275-released-1-july-2026"
    },
    {
      "type": "WEB",
      "url": "https://community.openvpn.net/Security%20Announcements/CVE-2026-12996"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2026/07/msg00013.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Mitigation MIT-5
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design

Strategy: Language Selection

Use a language that provides appropriate memory abstractions.

CAPEC-540: Overread Buffers

An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.