cve.bz

CWE-125: Out-of-bounds Read, page 62

Filter

The product reads data past the end, or before the beginning, of the intended buffer.

What the weakness is: CWE-125 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-540 Overread Buffers Likelihood: Low · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-125, as MITRE names them. Credits.

Ask an AI about CWE-125

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-125: Out-of-bounds Read and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/125.html and https://cve.bz/cve/cwe/125?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2022-50221EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: Fix out-of-bounds access Clip memory range to screen-buffer size to avoid out-of-bounds access in fbdev deferred I/O's damage handling. Fbdev's deferred …

  2. 7.1CVE-2022-50211EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: md-raid10: fix KASAN warning There's a KASAN warning in raid10_remove_disk when running the lvm test lvconvert-raid-reshape.sh. We fix this warning by verifying that the…

  3. 7.1CVE-2022-50200EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: selinux: Add boundary check in put_entry() Just like next_entry(), boundary check is necessary to prevent memory out-of-bound access.

  4. 7.1CVE-2022-50182EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Align upwards buffer size The hardware can support any image size WxH, with arbitrary W (image width) and H (image height) dimensions. Align upwards bu…

  5. 7.1CVE-2022-50147EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix get_nodes out of bound access When user specified more nodes than supported, get_nodes will access nmask array out of bounds.

  6. 7.1CVE-2022-50103EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed With cgroup v2, the cpuset's cpus_allowed mask can be empty indicating that the cpuset will just use…

  7. 7.1CVE-2022-50094EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: spmi: trace: fix stack-out-of-bound access in SPMI tracing functions trace_spmi_write_begin() and trace_spmi_read_end() both call memcpy() with a length of "len + 1". T…

  8. 7.1CVE-2022-50093EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) KASAN reports: [ 4.668325][ T0] BUG: KASAN: wild-memory-access in dmar_parse_one_rhsa (arch/x86/in…

  9. 7.1CVE-2022-50084EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: dm raid: fix address sanitizer warning in raid_status There is this warning when using a kernel with the address sanitizer and running this testsuite: https://gitlab.com…

  10. 7.1CVE-2022-50079EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check correct bounds for stream encoder instances for DCN303 [Why & How] eng_id for DCN303 cannot be more than 1, since we have only two instances of st…

  11. 7.1CVE-2022-50026EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: habanalabs/gaudi: fix shift out of bounds When validating NIC queues, queue offset calculation must be performed only for NIC queues.

  12. 7.1CVE-2022-49985EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: bpf: Don't use tnum_range on array range checking for poke descriptors Hsin-Wei reported a KASAN splat triggered by their BPF runtime fuzzer which is based on a customiz…

  13. 7.1CVE-2022-49961EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO Precision markers need to be propagated whenever we have an ARG_CONST_* style argument, as the verifier can…

  14. 7.1CVE-2022-49948EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: vt: Clear selection before changing the font When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the previous font. A previous selec…

  15. 7.1CVE-2022-49946EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Prevent out-of-bounds access The while loop in raspberrypi_discover_clocks() relies on the assumption that the id of the last clock element is zero. Becau…

  16. 7.1CVE-2022-49945EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix array out of bounds access The driver does not check if the cooling state passed to gpio_fan_set_cur_state() exceeds the maximum cooling state as s…

  17. 7.1CVE-2025-38081EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: spi-rockchip: Fix register out of bounds access Do not write native chip select stuff for GPIO chip selects. GPIOs can be numbered much higher than native CS. Also, it m…

  18. 7.1CVE-2025-38027EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: regulator: max20086: fix invalid memory access max20086_parse_regulators_dt() calls of_regulator_match() using an array of struct of_regulator_match allocated on the sta…

  19. 8.4CVE-2025-32412EPSS 0.2%

    Fuji Electric Smart Editor is vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code.

  20. 8.4CVE-2025-49849EPSS 0.2%

    An Out-of-bounds Read vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which can result in different memory corruption issues within the application, such as …

  21. 6.1CVE-2025-49175EPSS 0.3%

    A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.

  22. 9.3CVE-2025-5777KEVExploitEPSS >99.9%

    Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

  23. 9.1CVE-2025-49796EPSS 1.6%

    A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resul…

  24. 8.4CVE-2025-24311EPSS 2.0%

    An out-of-bounds read vulnerability exists in the cv_send_blockdata functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an informat…

  25. 5.5CVE-2025-49133EPSS 0.2%

    Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a …

  26. 5.5CVE-2025-47112EPSS 0.4%

    Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mit…

  27. 5.5CVE-2025-43578EPSS 0.5%

    Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mit…

  28. 6.6CVE-2025-2884EPSS 0.3%

    TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009…

  29. 5.5CVE-2025-47105EPSS 0.3%

    InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR.…

  30. 5.5CVE-2025-47104EPSS 0.3%

    InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR.…

  31. 5.5CVE-2025-33065EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  32. 5.5CVE-2025-33063EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  33. 5.5CVE-2025-33062EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  34. 5.5CVE-2025-33061EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  35. 5.5CVE-2025-33060EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  36. 5.5CVE-2025-33059EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  37. 5.5CVE-2025-33058EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  38. 5.5CVE-2025-33055EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  39. 5.5CVE-2025-32720EPSS 0.7%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  40. 5.5CVE-2025-32719EPSS 0.5%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  41. 7.8CVE-2025-32716EPSS 0.5%

    Out-of-bounds read in Windows Media allows an authorized attacker to elevate privileges locally.

  42. 6.5CVE-2025-32715EPSS 1.4%

    Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

  43. 5.5CVE-2025-24069EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  44. 5.5CVE-2025-24065EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  45. 6.6CVE-2025-5918EPSS 0.4%

    A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended co…

  46. 5.5CVE-2025-23235EPSS 0.1%

    in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through out-of-bounds read.

  47. 7.1CVE-2025-38004EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The content and also the length of th…

  48. 2.4CVE-2025-29871EPSS 0.1%

    An out-of-bounds read vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in…

  49. 7.7CVE-2025-20992EPSS 0.2%

    Out-of-bound read in libsecimaging.camera.samsung.so prior to SMR Feb-2025 Release 1 allows local attackers to read out-of-bounds memory.

  50. 7.1CVE-2025-20988EPSS 0.2%

    Out-of-bounds read in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to read out-of-bounds memory.