cve.bz

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer, page 71

Filter

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

What the weakness is: CWE-119 at MITRE

Related attack patterns (CAPEC): 12
  • CAPEC-8 Buffer Overflow in an API Call Likelihood: High · Severity: High
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities Likelihood: High · Severity: High
  • CAPEC-10 Buffer Overflow via Environment Variables Likelihood: High · Severity: High
  • CAPEC-14 Client-side Injection-induced Buffer Overflow Likelihood: Medium · Severity: High
  • CAPEC-24 Filter Failure through Buffer Overflow Likelihood: High · Severity: High
  • CAPEC-42 MIME Conversion Likelihood: High · Severity: High
  • CAPEC-44 Overflow Binary Resource File Likelihood: High · Severity: Very High
  • CAPEC-45 Buffer Overflow via Symbolic Links Likelihood: High · Severity: High
  • CAPEC-46 Overflow Variables and Tags Likelihood: High · Severity: High
  • CAPEC-47 Buffer Overflow via Parameter Expansion Likelihood: Medium · Severity: High
  • CAPEC-100 Overflow Buffers Likelihood: High · Severity: Very High
  • CAPEC-123 Buffer Manipulation Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-119, as MITRE names them. Credits.

Ask an AI about CWE-119

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/119.html and https://cve.bz/cve/cwe/119?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2021-40759EPSS 2.0%

    Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .m4a file, potentially resulting in arbitrary code execution in the context of the current user. User…

  2. 7.8CVE-2021-40758EPSS 2.0%

    Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User …

  3. 7.8CVE-2021-40757EPSS 2.1%

    Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious MXF file, potentially resulting in arbitrary code execution in the context of the current user. User …

  4. 7.8CVE-2021-40755EPSS 2.1%

    Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious SGI file in the DoReadContinue function, potentially resulting in arbitrary code execution in the con…

  5. 7.8CVE-2021-40754EPSS 2.2%

    Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User …

  6. 7.8CVE-2021-40753EPSS 2.2%

    Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious SVG file, potentially resulting in arbitrary code execution in the context of the current user. User …

  7. 7.8CVE-2021-40752EPSS 2.2%

    Adobe After Effects version 18.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .m4a file, potentially resulting in arbitrary code execution in the context of the current user. User i…

  8. 7.8CVE-2021-40751EPSS 2.2%

    Adobe After Effects version 18.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .m4a file, potentially resulting in arbitrary code execution in the context of the current user. User i…

  9. 7.8CVE-2021-40733EPSS 2.6%

    Adobe Animate version 21.0.9 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .psd file, potentially resulting in arbitrary code execution in the context of the current user. User inter…

  10. 7.8CVE-2021-33481EPSS 1.2%

    A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in try_to_divide_boxes() in pgm2asc.c.

  11. 7.8CVE-2021-33479EPSS 1.2%

    A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in measure_pitch() in pgm2asc.c.

  12. 7.8CVE-2021-43012EPSS 2.1%

    Adobe Prelude version 10.1 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation …

  13. 7.8CVE-2021-43011EPSS 2.1%

    Adobe Prelude version 10.1 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation …

  14. 7.8CVE-2021-42725EPSS 2.0%

    Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interac…

  15. 7.8CVE-2021-43013EPSS 2.0%

    Adobe Media Encoder version 15.4.1 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Explo…

  16. 7.8CVE-2021-42726EPSS 2.3%

    Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interac…

  17. 5.5CVE-2021-26336EPSS 0.2%

    Insufficient bounds checking in System Management Unit (SMU) may cause invalid memory accesses/updates that could result in SMU hang and subsequent failure to service any further requests from other components.

  18. 6.3CVE-2021-41289EPSS 0.2%

    ASUS P453UJ contains the Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. With a general user’s permission, local attackers can modify the BIOS by replacing or filling in the content of the designated …

  19. 7.8CVE-2021-1973EPSS 0.2%

    A FTM Diag command can allow an arbitrary write into modem OS space in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & …

  20. 7.5CVE-2021-31883EPSS 1.5%

    A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). When processing a DHCP ACK message, the DHCP client application does not validate the len…

  21. 7.5CVE-2021-31882EPSS 1.5%

    A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). The DHCP client application does not validate the length of the Domain Name Server IP opt…

  22. 7.5CVE-2021-41771EPSS 4.7%

    ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

  23. 9.8CVE-2021-37002EPSS 0.8%

    There is a Memory out-of-bounds access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause malicious code to be executed.

  24. 7.5CVE-2021-40117EPSS 1.7%

    A vulnerability in SSL/TLS message handler for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition …

  25. 7.5CVE-2021-34783EPSS 1.6%

    A vulnerability in the software-based SSL/TLS message handler of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to re…

  26. 7.5CVE-2021-34781EPSS 1.4%

    A vulnerability in the processing of SSH connections for multi-instance deployments of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affect…

  27. 8.1CVE-2021-34595EPSS 0.9%

    A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite.

  28. 8.8CVE-2021-34859EPSS 8.9%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a mal…

  29. 8.8CVE-2021-34856EPSS 0.3%

    This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order t…

  30. 8.8CVE-2021-38473EPSS 0.9%

    The affected product’s code base doesn’t properly control arguments for specific functions, which could lead to a stack overflow.

  31. 7.8CVE-2021-30316EPSS 0.2%

    Possible out of bound memory access due to improper boundary check while creating HSYNC fence in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

  32. 6.5CVE-2021-3746EPSS 1.0%

    A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile …

  33. 8.1CVE-2021-3889EPSS 1.3%

    libmobi is vulnerable to Use of Out-of-range Pointer Offset

  34. 8.1CVE-2021-3888EPSS 1.3%

    libmobi is vulnerable to Use of Out-of-range Pointer Offset

  35. 7.8CVE-2021-38442EPSS 1.0%

    FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in a heap-corruption condition. An attacker could leverage this vulnerability to execute cod…

  36. 7.8CVE-2021-38436EPSS 1.0%

    FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in a memory-corruption condition. An attacker could leverage this vulnerability to execute a…

  37. 8.8CVE-2021-41121EPSS 1.1%

    Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the sta…

  38. 7.1CVE-2021-25493EPSS 0.2%

    Lack of boundary checking of a buffer in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows OOB read

  39. 7.8CVE-2021-40715EPSS 2.1%

    Adobe Premiere Pro version 15.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .exr file, potentially resulting in arbitrary code execution in the context of the current user. User in…

  40. 7.8CVE-2021-40710EPSS 2.1%

    Adobe Premiere Pro version 15.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .svg file, potentially resulting in arbitrary code execution in the context of the current user. User in…

  41. 7.8CVE-2021-39832EPSS 2.0%

    Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by a memory corruption vulnerability due to insecure handling of a malicious PDF file, potentially resulting in arbitrary code execu…

  42. 7.8CVE-2021-39830EPSS 2.0%

    Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by a memory corruption vulnerability due to insecure handling of a malicious PDF file, potentially resulting in arbitrary code execu…

  43. 7.8CVE-2021-40703EPSS 1.7%

    Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious m4a file, potentially resulting in arbitrary code execution in the context of the current u…

  44. 7.8CVE-2021-40702EPSS 1.7%

    Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious psd file, potentially resulting in arbitrary code execution in the context of the current u…

  45. 7.8CVE-2021-40701EPSS 1.7%

    Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious m4a file, potentially resulting in arbitrary code execution in the context of the current u…

  46. 7.8CVE-2021-40700EPSS 1.7%

    Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious TIFF file, potentially resulting in arbitrary code execution in the context of the current …

  47. 7.8CVE-2021-39824EPSS 1.8%

    Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious png file, potentially resulting in arbitrary code execution in the context of the current u…

  48. 7.8CVE-2021-39819EPSS 1.7%

    Adobe InCopy version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious XML file, potentially resulting in arbitrary code execution in the context of the current user. User interacti…

  49. 7.8CVE-2021-39818EPSS 1.7%

    Adobe InCopy version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious TIFF file, potentially resulting in arbitrary code execution in the context of the current user. User interact…

  50. 7.8CVE-2021-40157EPSS 0.8%

    A user may be tricked into opening a malicious FBX file which may exploit an Untrusted Pointer Dereference vulnerability in FBX’s Review version 1.5.0 and prior causing it to run arbitrary code on the system.