CWE-125: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Also known as OOB read.
A kind of CWE-119 Buffer Overflow.
From the CWE List. © The MITRE Corporation.
Newest
- apple ipados, macos, tvos +3 more +5 moreAn out-of-bounds read issue was addressed with improved input validation. This issue is fixed in...8.1 High
- apple ipados, macos, tvos +4 more +6 moreAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26...5.5 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26...4.6 Medium
- apple macos, ios and ipados +1 moreThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7...5.5 Medium
- apple macos, ios and ipados +1 moreAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS...9.8 Critical
- apple ipados, macos, safari +5 more +7 moreAn out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in...8.1 High
- apple ipados, macos, tvos +4 more +6 moreAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26...7.1 High
- linux, linux kernel +1 moresctp: validate STALE_COOKIE cause length before reading staleness9.1 Critical
- linux, linux kernel +1 morenet: usb: net1080: validate packet_len before pad-byte access in rx_fixup8.1 High
- linux, linux kernel +1 moredrm/edid: fix OOB read in drm_parse_tiled_block()7.1 High
- linux, linux kernel +1 moreusbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()8.1 High
- gimp, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreGimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted icns images7.1 High
- boazsegev facil.iofacil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS8.7 High
- boazsegev facil.iofacil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser8.7 High
- hdfgroup hdf5HDF5 SOHM List Index Heap Buffer Overflow5.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreBinutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service5.6 Medium
- ggml-org whisper.cppggml-org whisper.cpp log_mel_spectrogram out-of-bounds4.8 Medium
- apache thriftApache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass8.7 High
- apache thriftApache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path6.9 Medium
- linuxstaging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop8.1 High
- linux, linux kernel +1 moreusb: gadget: function: rndis: add length check for header5.5 Medium
- linux, linux kernel +1 moreALSA: virtio: Validate control metadata from the device8.4 High
- linux, linux kernel +1 moreALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser7.1 High
- linux, linux kernel +1 morex86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled7.1 High
- linux, linux kernel +1 morePCI/IOV: Skip VF Resizable BAR restore on read error7.0 High
- linux, linux kernel +1 morehwrng: virtio: clamp device-reported used.len at copy_data()7.7 High
- linux, linux kernel +1 moretipc: fix out-of-bounds read in broadcast Gap ACK blocks9.1 Critical
- linux, linux kernel +1 moresmb: client: restrict implied bcc[0] exemption to responses without data area8.2 High
- linux, linux kernel +1 morestaging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()8.8 High
- linux, linux kernel +1 morestaging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop8.1 High
- linux, linux kernel +1 morestaging: rtl8723bs: fix OOB read in update_beacon_info() IE loop8.1 High
- linux, linux kernel +1 morestaging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()8.1 High
- linux, linux kernel +1 morestaging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()8.8 High
- linux, linux kernel +1 morenet: af_key: initialize alg_key_len for IPComp states7.1 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: ebtables: module names must be null-terminated7.1 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: ebtables: terminate table name before find_table_lock()7.1 High
- linux, linux kernel +1 moreBluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()7.1 High
- linux, linux kernel +1 moreBluetooth: L2CAP: validate option length before reading conf opt value7.1 High
- linux, linux kernel +1 moresmb: client: harden POSIX SID length parsing8.2 High
- linux, linux kernel +1 moreHID: multitouch: fix out-of-bounds bit access on mt_io_flags8.8 High
- linux, linux kernel +1 morebpf: Reject fragmented frames in devmap9.8 Critical
- linux, linux kernel +1 moreusb: misc: usbio: bound bulk IN response length to the received transfer7.1 High
- linux, linux kernel +1 moreudf: validate free block extents against the partition length7.8 High
- linux, linux kernel +1 moreudf: validate VAT header length against the VAT inode size7.1 High
- linux, linux kernel +1 morenvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page9.1 Critical
- linux, linux kernel +1 morenvmet-auth: validate reply message payload bounds against transfer length9.1 Critical
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreisofs: bound Rock Ridge symlink components to the SL record7.1 High
- linux, linux kernel +1 moretracing: Prevent out-of-bounds read in glob matching7.1 High
- linux, linux kernel +1 moreKVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU8.2 High
- linux, linux kernel +1 moreInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count7.8 High
- Show moreLoading…