Common Weakness Enumeration
CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
11458 vulnerabilities reference this CWE, most recent first.
GHSA-98G9-5FPQ-HX7C
Vulnerability from github – Published: 2026-06-16 21:32 – Updated: 2026-06-17 18:35
VLAI
Details
In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-0140"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-16T20:16:24Z",
"severity": "MODERATE"
},
"details": "In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.",
"id": "GHSA-98g9-5fpq-hx7c",
"modified": "2026-06-17T18:35:21Z",
"published": "2026-06-16T21:32:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0140"
},
{
"type": "WEB",
"url": "https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-98J3-HJH2-Q3PV
Vulnerability from github – Published: 2026-01-02 18:30 – Updated: 2026-01-05 21:30
VLAI
Details
An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data.
We have already fixed the vulnerability in the following version: License Center 2.0.36 and later
Severity
{
"affected": [],
"aliases": [
"CVE-2025-52871"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-02T16:16:59Z",
"severity": "LOW"
},
"details": "An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data.\n\nWe have already fixed the vulnerability in the following version:\nLicense Center 2.0.36 and later",
"id": "GHSA-98j3-hjh2-q3pv",
"modified": "2026-01-05T21:30:31Z",
"published": "2026-01-02T18:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52871"
},
{
"type": "WEB",
"url": "https://www.qnap.com/en/security-advisory/qsa-25-52"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-98J5-35X9-CVVC
Vulnerability from github – Published: 2022-08-19 00:00 – Updated: 2022-08-23 00:00
VLAI
Details
Out of bounds read for some Intel(R) PROSet/Wireless WiFi products may allow a privileged user to potentially enable information disclosure via local access.
Severity
4.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-21240"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-18T20:15:00Z",
"severity": "MODERATE"
},
"details": "Out of bounds read for some Intel(R) PROSet/Wireless WiFi products may allow a privileged user to potentially enable information disclosure via local access.",
"id": "GHSA-98j5-35x9-cvvc",
"modified": "2022-08-23T00:00:18Z",
"published": "2022-08-19T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21240"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00621.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-98J5-4649-RFV2
Vulnerability from github – Published: 2025-09-03 15:30 – Updated: 2025-11-03 21:34
VLAI
Details
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-57052"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-03T15:15:38Z",
"severity": "CRITICAL"
},
"details": "cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.",
"id": "GHSA-98j5-4649-rfv2",
"modified": "2025-11-03T21:34:25Z",
"published": "2025-09-03T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57052"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00019.html"
},
{
"type": "WEB",
"url": "https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-98J9-86Q7-C5R2
Vulnerability from github – Published: 2022-05-14 00:59 – Updated: 2022-05-14 00:59
VLAI
Details
In The Sleuth Kit (TSK) through 4.6.4, hfs_cat_traverse in tsk/fs/hfs.c does not properly determine when a key length is too large, which allows attackers to cause a denial of service (SEGV on unknown address with READ memory access in a tsk_getu16 call in hfs_dir_open_meta_cb in tsk/fs/hfs_dent.c).
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-19497"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-29T23:29:00Z",
"severity": "MODERATE"
},
"details": "In The Sleuth Kit (TSK) through 4.6.4, hfs_cat_traverse in tsk/fs/hfs.c does not properly determine when a key length is too large, which allows attackers to cause a denial of service (SEGV on unknown address with READ memory access in a tsk_getu16 call in hfs_dir_open_meta_cb in tsk/fs/hfs_dent.c).",
"id": "GHSA-98j9-86q7-c5r2",
"modified": "2022-05-14T00:59:45Z",
"published": "2022-05-14T00:59:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19497"
},
{
"type": "WEB",
"url": "https://github.com/sleuthkit/sleuthkit/pull/1374"
},
{
"type": "WEB",
"url": "https://github.com/sleuthkit/sleuthkit/commit/bc04aa017c0bd297de8a3b7fc40ffc6ddddbb95d"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00008.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/06/msg00015.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZXFYOOMSP7NWRTSO4XXGHXAY3CJNAJ6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NLSVLDQLPGKRHHBPYUXVJJPAID6CYBXD"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-98JW-M4Q8-F849
Vulnerability from github – Published: 2022-05-24 19:14 – Updated: 2022-05-24 19:14
VLAI
Details
A vulnerability has been identified in NX 1980 Series (All versions < V1984). The plmxmlAdapterIFC.dll contains an out-of-bounds read while parsing user supplied IFC files which could result in a read past the end of an allocated buffer. This could allow an attacker to cause a denial-of-service condition or read sensitive information from memory locations.
{
"affected": [],
"aliases": [
"CVE-2021-37203"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-14T11:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in NX 1980 Series (All versions \u003c V1984). The plmxmlAdapterIFC.dll contains an out-of-bounds read while parsing user supplied IFC files which could result in a read past the end of an allocated buffer. This could allow an attacker to cause a denial-of-service condition or read sensitive information from memory locations.",
"id": "GHSA-98jw-m4q8-f849",
"modified": "2022-05-24T19:14:29Z",
"published": "2022-05-24T19:14:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37203"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-208530.pdf"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-728618.pdf"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-98MG-WXRJ-PFCV
Vulnerability from github – Published: 2022-06-09 00:00 – Updated: 2022-06-16 00:00
VLAI
Details
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by out-of-bound read/write and can be exploited by attackers to make denial of service.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2020-14125"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-08T15:15:00Z",
"severity": "HIGH"
},
"details": "A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by out-of-bound read/write and can be exploited by attackers to make denial of service.",
"id": "GHSA-98mg-wxrj-pfcv",
"modified": "2022-06-16T00:00:30Z",
"published": "2022-06-09T00:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14125"
},
{
"type": "WEB",
"url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=170"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-98QW-PRQM-9F4P
Vulnerability from github – Published: 2025-06-26 21:31 – Updated: 2026-02-27 18:31
VLAI
Details
A flaw was found in the libssh library. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-5318"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-24T14:15:30Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the libssh library. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.",
"id": "GHSA-98qw-prqm-9f4p",
"modified": "2026-02-27T18:31:00Z",
"published": "2025-06-26T21:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5318"
},
{
"type": "WEB",
"url": "https://www.libssh.org/security/advisories/CVE-2025-5318.txt"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369131"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-5318"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3462"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3461"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:1541"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0326"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23080"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23079"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23078"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22275"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21829"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21329"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21013"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:20943"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19864"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19807"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19472"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19470"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19401"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19400"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19313"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19300"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19295"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19101"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19098"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19012"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:18286"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:18275"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:18231"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-98R3-FV2H-4H72
Vulnerability from github – Published: 2026-06-13 00:34 – Updated: 2026-06-13 00:34
VLAI
Details
Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.56.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2025-7003"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-12T22:16:48Z",
"severity": "HIGH"
},
"details": "Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.\n\nThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.56.",
"id": "GHSA-98r3-fv2h-4h72",
"modified": "2026-06-13T00:34:30Z",
"published": "2026-06-13T00:34:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7003"
},
{
"type": "WEB",
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-98VG-QMPV-23VR
Vulnerability from github – Published: 2022-05-13 01:43 – Updated: 2025-11-03 21:30
VLAI
Details
In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2017-14227"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-09T08:29:00Z",
"severity": "HIGH"
},
"details": "In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.",
"id": "GHSA-98vg-qmpv-23vr",
"modified": "2025-11-03T21:30:29Z",
"published": "2022-05-13T01:43:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14227"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489355"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489356"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489362"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100825"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.