CWE-125: Out-of-bounds Read, page 20
Filter
The product reads data past the end, or before the beginning, of the intended buffer.
What the weakness is: CWE-125 at MITRE
Ask an AI about CWE-125
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-125: Out-of-bounds Read and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/125.html and https://cve.bz/cve/cwe/125?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 4.7CVE-2026-68891EPSS 0.3%
Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.
- 7.5CVE-2026-68887EPSS 1.2%
Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to deny service over a network.
- 5.5CVE-2026-68881EPSS 0.4%
Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.
- 5.7CVE-2026-68874EPSS 0.9%
Out-of-bounds read in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information over a network.
- 4.7CVE-2026-68849EPSS 0.3%
Out-of-bounds read in Windows Bluetooth Port Driver allows an authorized attacker to disclose information locally.
- 6.5CVE-2026-68784EPSS 1.0%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- 6.5CVE-2026-68781EPSS 1.0%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- 6.5CVE-2026-68780EPSS 1.0%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- 6.5CVE-2026-68779EPSS 1.0%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- 6.5CVE-2026-68778EPSS 1.0%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- 6.5CVE-2026-68777EPSS 1.0%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- 6.5CVE-2026-67645EPSS 1.0%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- 9.0CVE-2026-67636EPSS 0.7%
Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.
- 6.5CVE-2026-67633EPSS 1.1%
Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.
- 6.5CVE-2026-67630EPSS 1.0%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- 6.5CVE-2026-67629EPSS 1.0%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- 6.5CVE-2026-67624EPSS 1.0%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- 6.5CVE-2026-67389EPSS 1.0%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- 6.5CVE-2026-67369EPSS 1.0%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- 8.8CVE-2026-62706EPSS 0.8%
Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
- 7.8CVE-2026-56198EPSS 0.3%
Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.
- 5.3CVE-2026-82066EPSS 0.4%
A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the s…
- 5.3CVE-2026-86714EPSS 0.3%
PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyo…
- 6.9CVE-2026-86303EPSS 0.5%
A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a manipulation can lead to out-of-bounds read. The attack can be execut…
- 2.1CVE-2026-86288EPSS 0.5%
A vulnerability has been found in ModelCloud GPTQModel up to 7.2.0. This vulnerability affects unknown code of the file gptqmodel/nn_modules/qlinear/tritonv2.py of the component Triton dequantization kernel. Such manipulation of the argume…
- 4.2CVE-2026-20518EPSS 0.2%
In geniezone, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is needed for exploita…
- 1.3CVE-2026-86227EPSS 0.5%
A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the…
- 5.5CVE-2026-31912EPSS 0.1%
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular un…
- 8.7CVE-2026-0799EPSS 0.1%
In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cas…
- 6.8CVE-2025-15647EPSS 0.2%
CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge intersections are computed in floating point and round outside adjacent triangles. Attackers can supply nearly-degenerate…
- 4.8CVE-2025-15614EPSS 0.2%
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated hea…
- 6.1CVE-2026-86137EPSS 0.2%
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.
- 6.5CVE-2026-85769EPSS 0.4%
A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on or state/migration restore), a malformed state blob can supply an oversized skip…
- 5.3CVE-2026-16660EPSS 0.5%
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
- 6.8CVE-2026-85698EPSS 0.2%
Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without bounds validation. Attackers can craft a malicious database file with a modified…
- 5.5CVE-2026-85522EPSS 0.9%
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument…
- 7.5CVE-2026-85505EPSS 0.4%
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has…
- 4.4CVE-2026-49509EPSS 0.1%
Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers. This issue affects rLottie: 25648aef19187b3f87f4d9420b8d761453ad4630.
- 8.8CVE-2026-85455EPSS 0.7%
MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four-byte packet triggers out-of-bounds memory access during deserialization. Attackers can open a TCP connection to the MOOSDB port and send a…
- 8.7CVE-2026-85444EPSS 0.8%
MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using the original string length. Attackers can send NODE_REPORT messages with leading…
- 8.5CVE-2026-64200EPSS 0.2%
There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a past the end of an allocated heap buffer during string conversion. Successful exploitation requires an at…
- 8.6CVE-2026-64199EPSS 0.2%
There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read outside the bounds of an allocated data structure. Successful exploitation requires an attacker to get a us…
- 8.5CVE-2026-64198EPSS 0.2%
There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a few bytes past the end of an allocated heap buffer during file handling. Successful exploitation requires…
- 3.1CVE-2026-85052EPSS 0.2%
Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 6.9CVE-2026-84968EPSS 0.2%
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is re…
- 5.3CVE-2026-85090EPSS 0.3%
FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFX_AVC444_BITMAP_STREAM with specific frame geom…
- 6.3CVE-2026-71222EPSS 0.1%
A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory conte…
- 8.7CVE-2026-84484EPSS 0.9%
ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. Attackers can send a UDP datagram to the LTP…
- 6.5CVE-2026-73761EPSS 0.3%
An out-of-bounds read vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated information disclosure by sending a specially crafted packet. Successful exploitation of this vulnerability results …
- 2.9CVE-2026-52295EPSS 0.2%
FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c.