CWE-125: Out-of-bounds Read, page 66
Filter
The product reads data past the end, or before the beginning, of the intended buffer.
What the weakness is: CWE-125 at MITRE
Related attack patterns (CAPEC): 1
- CAPEC-540 Overread Buffers Likelihood: Low · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-125, as MITRE names them. Credits.
Ask an AI about CWE-125
Show the prompt
Explain CWE-125: Out-of-bounds Read and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/125.html and https://cve.bz/cve/cwe/125?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.1CVE-2025-22112EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix out-of-range access of vnic_info array The bnxt_queue_{start | stop}() access vnic_info as much as allocated, which indicates bp->nr_vnics. So, it should …
- 7.1CVE-2025-22107EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() There are actually 2 problems: - deleting the last element doesn't require the memmove…
- 7.1CVE-2025-22104EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Use kernel helpers for hex dumps Previously, when the driver was printing hex dumps, the buffer was cast to an 8 byte long and printed using string formatters. …
- 7.1CVE-2025-22087EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix array bounds error with may_goto may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating in…
- 7.1CVE-2025-22079EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate l_tree_depth to avoid out-of-bounds access The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH. A…
- 7.1CVE-2025-22039EPSS 0.8%
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix overflow in dacloffset bounds check The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the ex…
- 7.1CVE-2025-22038EPSS 0.6%
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate zero num_subauth before sub_auth is accessed Access psid->sub_auth[psid->num_subauth - 1] without checking if num_subauth is non-zero leads to an out-of-…
- 7.1CVE-2023-53034EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xl…
- 5.5CVE-2025-32776EPSS 0.2%
OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specially crafted data to the `matrix_custom_frame` file, an attacker can cause the custom kernel driver …
- 7.4CVE-2025-32914EPSS 0.8%
A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.
- 7.5CVE-2025-32906EPSS 1.0%
A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.
- 7.5CVE-2025-29834EPSS 0.6%
Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- 6.7CVE-2024-11679EPSS 0.2%
An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker with elevated privileges to read the contents of memory.
- 5.3CVE-2025-31354EPSS 0.1%
Subnet Solutions PowerSYSTEM Center's SMTPS notification service can be affected by importing an EC certificate with crafted F2m parameters, which can lead to excessive CPU consumption during the evaluation of the curve parameters.
- 6.4CVE-2023-42982EPSS 0.3%
Processing a file may lead to a denial-of-service or potentially disclose memory contents. This issue is fixed in macOS 14. The issue was addressed with improved checks.
- 9.1CVE-2025-32460EPSS 0.4%
GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.
- 5.5CVE-2025-30309EPSS 0.3%
XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation …
- 5.5CVE-2025-30308EPSS 0.2%
XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation …
- 5.5CVE-2025-30307EPSS 0.2%
XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation …
- 5.5CVE-2025-30306EPSS 0.3%
XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation …
- 5.5CVE-2025-30305EPSS 0.2%
XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation …
- 5.5CVE-2025-30303EPSS 0.2%
Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. E…
- 5.5CVE-2025-30302EPSS 0.2%
Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. E…
- 7.8CVE-2025-29811EPSS 0.6%
Improper input validation in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.
- 5.5CVE-2025-27742EPSS 0.9%
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to disclose information locally.
- 7.8CVE-2025-27741EPSS 0.8%
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
- 7.8CVE-2025-27733EPSS 0.7%
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
- 7.8CVE-2025-27728EPSS 0.6%
Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-27490EPSS 0.6%
Heap-based buffer overflow in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-27483EPSS 0.8%
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
- 5.5CVE-2025-27204EPSS 0.3%
After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploi…
- 5.5CVE-2025-27202EPSS 0.3%
Animate versions 24.0.7, 23.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitat…
- 5.5CVE-2025-27201EPSS 0.3%
Animate versions 24.0.7, 23.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitat…
- 5.5CVE-2025-27187EPSS 0.3%
After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploi…
- 5.5CVE-2025-27186EPSS 0.3%
After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploi…
- 5.5CVE-2025-27184EPSS 0.3%
After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploi…
- 7.8CVE-2025-26675EPSS 0.6%
Out-of-bounds read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
- 8.8CVE-2025-26669EPSS 1.5%
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
- 7.8CVE-2025-26642EPSS 0.8%
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
- 8.5CVE-2025-3288EPSS 0.3%
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited…
- 8.5CVE-2025-3287EPSS 0.3%
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose informatio…
- 8.5CVE-2025-3286EPSS 0.3%
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited…
- 8.5CVE-2025-3285EPSS 0.3%
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited…
- 7.1CVE-2025-20948EPSS 0.2%
Out-of-bounds read in enrollment with cdsp frame secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged attackers to read out-of-bounds memory.
- 7.1CVE-2025-20944EPSS 0.2%
Out-of-bounds read in parsing audio data in libsavsac.so prior to SMR Apr-2025 Release 1 allows local attackers to read out-of-bounds memory.
- 5.3CVE-2025-3407EPSS 0.5%
A vulnerability was found in Nothings stb up to f056911. It has been declared as critical. Affected by this vulnerability is the function stbhw_build_tileset_from_image. The manipulation of the argument h_count/v_count leads to out-of-boun…
- 5.3CVE-2025-3406EPSS 0.6%
A vulnerability was found in Nothings stb up to f056911. It has been classified as problematic. Affected is the function stbhw_build_tileset_from_image of the component Header Array Handler. The manipulation of the argument w leads to out-…
- 4.6CVE-2024-38797EPSS 0.2%
EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Int…
- 7.8CVE-2025-21438EPSS 0.1%
Memory corruption while IOCTL call is invoked from user-space to read board data.
- 6.7CVE-2025-20662EPSS 0.09%
In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for expl…