CWE-823: Use of Out-of-range Pointer Offset
Filter
The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
What the weakness is: CWE-823 at MITRE. All weaknesses
Related attack patterns (CAPEC): 1
- CAPEC-129 Pointer Manipulation Severity: Medium
The attack patterns MITRE's CAPEC relates to CWE-823, as MITRE names them. Credits.
Ask an AI about CWE-823
Show the prompt
Explain CWE-823: Use of Out-of-range Pointer Offset and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/823.html and https://cve.bz/cve/cwe/823?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 8.8CVE-2026-74915EPSS 0.3%
A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload…
- 9.8CVE-2026-74912EPSS 0.3%
On GPU systems with the security vulnerability fix for CVE-2026-49746 applied, the mapping range of graphics buffers is limited which causes errors when the mapping outside of that range. Integer truncation caused when mapping GPU buffer …
- 7.2CVE-2026-93862EPSS 0.2%
An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster…
- 2.5CVE-2026-107570EPSS 0.2%
heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.
- 7.1CVE-2026-104944EPSS 0.3%
TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a …
- 8.5CVE-2026-102757EPSS 0.1%
An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Module …
- 7.7CVE-2026-48977EPSS 0.5%
OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file…
- 5.5CVE-2026-31912EPSS 0.1%
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular un…
- 7.8CVE-2026-45199EPSS 0.2%
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands …
- 8.8CVE-2026-72642EPSS 0.6%
The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays w…
- 7.1CVE-2026-49746EPSS 0.2%
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB …
- 7.8CVE-2026-49745EPSS 0.2%
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands …
- 7.8CVE-2026-49744EPSS 0.2%
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Gu…
- 7.7CVE-2026-21734EPSS 0.2%
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privi…
- 8.1CVE-2026-12290EPSS 0.4%
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
- 9.1CVE-2026-46244EPSS 0.4%
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header …
- 4.3CVE-2026-34193EPSS 0.1%
Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory. A logic error in the address translation allowed a compromised Host …
- 7.8CVE-2026-28764EPSS 0.2%
A heap-based buffer overflow vulnerability exists in the LXF element parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted .lxf file can lead to arbitrary code execution. An attacker can provide a malicious file to…
- 8.3CVE-2026-42946EPSS 0.9%
A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-i…
- 8.1CVE-2026-41907EPSS 0.4%
uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-p…
- 6.8CVE-2025-33215EPSS 0.2%
NVIDIA SNAP-4 Container contains a vulnerability in the VIRTIO-BLK component where a malicious guest VM may cause use of out-of-range pointer offset by sending crafted messages. A successful exploit of this vulnerability may lead to a deni…
- 7.5CVE-2026-4693EPSS 0.7%
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
- 9.6CVE-2026-21732EPSS 0.3%
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privi…
- 8.2CVE-2026-32829EPSS 0.6%
lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression oper…
- 6.5CVE-2026-20022EPSS 0.2%
A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition whe…
- 1.3CVE-2025-54152EPSS 0.4%
A use of out-of-range pointer offset vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read sensitive portions of memory. We have already fixed t…
- 6.8CVE-2026-23764EPSS 0.2%
VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlie…
- 7.1CVE-2026-21487EPSS 0.2%
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have an Out-of-bounds Read, Use of Out-of-range Pointer Offset and have Improper Input Validation in its CIccProfile::L…
- 8.6CVE-2017-20211EPSS 0.8%
UCanCode E-XD++ Visualization Enterprise Suite contains an untrusted pointer dereference vulnerability via the TKDRAWCAD.TKDrawCADCtrl.1 ActiveX control. This is because it exposes a RotateShape method that dereferences a user-supplied poi…
- 7.5CVE-2025-11232EPSS 0.4%
To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualif…
- 7.8CVE-2025-47349EPSS 0.09%
Memory corruption while processing an escape call.
- 8.8CVE-2025-27059EPSS 0.09%
Memory corruption while performing SCM call.
- 7.8CVE-2025-25180EPSS 0.2%
Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allo…
- 6.6CVE-2024-53017EPSS 0.10%
Memory corruption while handling test pattern generator IOCTL command.
- 6.9CVE-2025-46806EPSS 0.5%
A Use of Out-of-range Pointer Offset vulnerability in sslh leads to denial of service on some architectures.This issue affects sslh before 2.2.4.
- 6.5CVE-2024-47893EPSS 0.3%
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to read and/or write data outside the Guest's virtualised GPU memory.
- 7.8CVE-2024-45570EPSS 0.1%
Memory corruption may occur during IO configuration processing when the IO port count is invalid.
- 8.2CVE-2025-0467EPSS 0.2%
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
- 7.8CVE-2024-45557EPSS 0.1%
Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation.
- 7.8CVE-2024-43060EPSS 0.1%
Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.
- 7.8CVE-2024-52939EPSS 0.2%
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write data outside the Guest's virtualised GPU memory.
- 3.3CVE-2024-47896EPSS 0.2%
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
- 7.3CVE-2024-12577EPSS 0.2%
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
- 7.8CVE-2024-49840EPSS 0.07%
Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality.
- 7.8CVE-2024-45573EPSS 0.1%
Memory corruption may occour while generating test pattern due to negative indexing of display ID.
- 7.8CVE-2024-47900EPSS 0.2%
Software installed and run as a non-privileged user may conduct improper GPU system calls to access OOB kernel memory.
- 7.8CVE-2024-52938EPSS 0.2%
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to subvert reconstruction activities to trigger a write of data outside the Guest's virtualised GPU memory.
- 6.7CVE-2024-52937EPSS 0.2%
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
- 4.4CVE-2024-52936EPSS 0.2%
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to write data outside the Guest's virtualised GPU memory.
- 4.1CVE-2024-52935EPSS 0.2%
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.