cve.bz

CWE-125: Out-of-bounds Read, page 69

Filter

The product reads data past the end, or before the beginning, of the intended buffer.

What the weakness is: CWE-125 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-540 Overread Buffers Likelihood: Low · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-125, as MITRE names them. Credits.

Ask an AI about CWE-125

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-125: Out-of-bounds Read and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/125.html and https://cve.bz/cve/cwe/125?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2025-20042EPSS 0.2%

    in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read.

  2. 5.5CVE-2025-20021EPSS 0.1%

    in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.

  3. 6.5CVE-2024-43056EPSS 0.1%

    Transient DOS during hypervisor virtual I/O operation in a virtual machine.

  4. 4.6CVE-2025-20652EPSS 0.1%

    In V5 DA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interac…

  5. 4.1CVE-2025-20651EPSS 0.09%

    In da, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interactio…

  6. 5.5CVE-2025-20648EPSS 0.08%

    In apu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09…

  7. 7.1CVE-2025-21815EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: mm/compaction: fix UBSAN shift-out-of-bounds warning syzkaller reported a UBSAN shift-out-of-bounds warning of (1UL << order) in isolate_freepages_block(). The bogus co…

  8. 7.1CVE-2025-21794EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints() Syzbot[1] has detected a stack-out-of-bounds read of the ep_addr array from hid-thrustma…

  9. 7.1CVE-2025-21789EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: LoongArch: csum: Fix OoB access in IP checksum code for negative lengths Commit 69e3a6aa6be2 ("LoongArch: Add checksum optimization for 64-bit system") would cause an un…

  10. 7.1CVE-2025-21782EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: orangefs: fix a oob in orangefs_debug_write I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's …

  11. 7.1CVE-2025-21743EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: fix possible overflow in DPE length check Originally, it was possible for the DPE length check to overflow if wDatagramIndex + wDatagramLength > U16_MAX.…

  12. 7.1CVE-2025-21742EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: use static NDP16 location in URB Original code allowed for the start of NDP16 to be anywhere within the URB based on the `wNdpIndex` value in NTH16. Only…

  13. 7.1CVE-2025-21741EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: fix DPE OoB read Fix an out-of-bounds DPE read, limit the number of processed DPEs to the amount that fits into the fixed-size NDP16 header.

  14. 7.1CVE-2024-58015EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix for out-of bound access error Selfgen stats are placed in a buffer using print_array_to_buf_index() function. Array length parameter passed to the func…

  15. 7.1CVE-2024-58014EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() In 'wlc_phy_iqcal_gainparams_nphy()', add gain range check to WARN() instead of possible out-of-b…

  16. 7.1CVE-2024-58007EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: soc: qcom: socinfo: Avoid out of bounds read of serial number On MSM8916 devices, the serial number exposed in sysfs is constant and does not change across individual de…

  17. 7.1CVE-2025-21719EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: ipmr: do not call mr_mfc_uses_dev() for unres entries syzbot found that calling mr_mfc_uses_dev() for unres entries would crash [1], because c->mfc_un.res.minvif / c->mf…

  18. 7.1CVE-2025-21717EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq kvzalloc_node is not doing a runtime check on the node argument (__alloc_pages_node_nopr…

  19. 7.8CVE-2024-57998EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: OPP: add index check to assert to avoid buffer overflow in _read_freq() Pass the freq index to the assert function to make sure we do not read a freq out of the opp->rat…

  20. 7.1CVE-2024-57982EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: xfrm: state: fix out-of-bounds read during lookup lookup and resize can run in parallel. The xfrm_state_hash_generation seqlock ensures a retry, but the hash functions …

  21. 7.1CVE-2022-49706EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: zonefs: fix zonefs_iomap_begin() for reads If a readahead is issued to a sequential zone file with an offset exactly equal to the current file size, the iomap type is se…

  22. 7.1CVE-2022-49674EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: dm raid: fix accesses beyond end of raid member array On dm-raid table load (using raid_ctr), dm-raid allocates an array rs->devs[rs->raid_disks] for the raid device mem…

  23. 7.1CVE-2022-49623EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: powerpc/xive/spapr: correct bitmap allocation size kasan detects access beyond the end of the xibm->bitmap allocation: BUG: KASAN: slab-out-of-bounds in _find_first_zer…

  24. 7.1CVE-2022-49560EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: exfat: check if cluster num is valid Syzbot reported slab-out-of-bounds read in exfat_clear_bitmap. This was triggered by reproducer calling truncute with size 0, which …

  25. 7.1CVE-2022-49551EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: usb: isp1760: Fix out-of-bounds array access Running the driver through kasan gives an interesting splat: BUG: KASAN: global-out-of-bounds in isp1760_register+0x180/0…

  26. 7.1CVE-2022-49518EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-topology: Correct get_control_data for non bytes payload It is possible to craft a topology where sof_get_control_data() would do out of bounds access be…

  27. 7.1CVE-2022-49515EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: ASoC: cs35l41: Fix an out-of-bounds access in otp_packed_element_t The CS35L41_NUM_OTP_ELEM is 100, but only 99 entries are defined in the array otp_map_1/2[CS35L41_NUM_…

  28. 7.1CVE-2022-49503EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to ensure that it …

  29. 7.1CVE-2022-49444EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: module: fix [e_shstrndx].sh_size=0 OOB access It is trivial to craft a module to trigger OOB access in this line: if (info->secstrings[strhdr->sh_size - 1] != '\0') { …

  30. 7.1CVE-2022-49407EPSS 0.9%

    In the Linux kernel, the following vulnerability has been resolved: dlm: fix plock invalid read This patch fixes an invalid read showed by KASAN. A unlock will allocate a "struct plock_op" and a followed send_op() will append it to a glo…

  31. 7.1CVE-2022-49401EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: mm/page_owner: use strscpy() instead of strlcpy() current->comm[] is not a string (no guarantee for a zero byte in it). strlcpy(s1, s2, l) is calling strlen(s2), potent…

  32. 7.1CVE-2022-49395EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: um: Fix out-of-bounds read in LDT setup syscall_stub_data() expects the data_count parameter to be the number of longs, not bytes. ====================================…

  33. 7.1CVE-2022-49368EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry() The "fsp->location" variable comes from user via ethtool_get_rxnfc(). Check that it is valid…

  34. 7.8CVE-2022-49261EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: add missing boundary check in vm_access A missing bounds check in vm_access() can lead to an out-of-bounds read or write in the adjacent memory area, since…

  35. 7.1CVE-2022-49252EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type Accessing enums using integer would result in array out of bounds access on platforms like aarch6…

  36. 7.1CVE-2022-49251EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: va-macro: fix accessing array out of bounds for enum type Accessing enums using integer would result in array out of bounds access on platforms like aarch6…

  37. 7.1CVE-2022-49250EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rx-macro: fix accessing compander for aux AUX interpolator does not have compander, so check before accessing compander data for this. Without this checka…

  38. 7.1CVE-2022-49249EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wc938x: fix accessing array out of bounds for enum type Accessing enums using integer would result in array out of bounds access on platforms like aarch64 …

  39. 7.1CVE-2022-49234EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net: dsa: Avoid cross-chip syncing of VLAN filtering Changes to VLAN filtering are not applicable to cross-chip notifications. On a system like this: .-----. .-----.…

  40. 7.1CVE-2022-49218EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/dp: Fix OOB read when handling Post Cursor2 register The link_status array was not large enough to read the Adjust Request Post Cursor2 register, so remove the commo…

  41. 7.1CVE-2022-49163EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: fix a bug of accessing array out of bounds When error occurs in parsing jpeg, the slot isn't acquired yet, it may be the default value MXC_MAX_SLOTS. If…

  42. 7.1CVE-2022-49145EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data If the NumEntries field in the _CPC return package is less than 2, do not attempt to access the "Revision" …

  43. 7.1CVE-2022-49094EPSS 0.7%

    In the Linux kernel, the following vulnerability has been resolved: net/tls: fix slab-out-of-bounds bug in decrypt_internal The memory size of tls_ctx->rx.iv for AES128-CCM is 12 setting in tls_set_sw_offload(). The return value of crypt…

  44. 6.8CVE-2022-49051EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup aqc111_rx_fixup() contains several out-of-bounds accesses that can be triggered by a malicious (or defective) US…

  45. 7.1CVE-2021-47636EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() Function ubifs_wbuf_write_nolock() may access buf out of bounds in following process: ubifs_wbuf_write_nolock…

  46. 7.1CVE-2021-47633EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 The bug was found during fuzzing. Stacktrace locates it in ath5k_eeprom_convert_pcal_info_5111. When none of the curve…

  47. 3.3CVE-2024-53876EPSS 0.3%

    NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successful exploit of this vulnerability might lead to a p…

  48. 3.3CVE-2024-53875EPSS 0.3%

    NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a…

  49. 3.3CVE-2024-53874EPSS 0.3%

    NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a…

  50. 3.3CVE-2024-53873EPSS 0.3%

    NVIDIA CUDA toolkit for Windows contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a parti…