CWE-125 (跨界内存读) — Vulnerability Class 4332

4332 vulnerabilities classified as CWE-125 (跨界内存读). AI Chinese analysis included.

CWE-125, Out-of-bounds Read, is a memory safety weakness where software accesses memory locations outside the designated buffer boundaries, either before its start or past its end. This vulnerability typically arises from insufficient bounds checking during array indexing or pointer arithmetic, allowing attackers to read sensitive data such as stack canaries, cryptographic keys, or internal application state. By leveraging this flaw, adversaries can achieve information disclosure or potentially facilitate further exploitation techniques like heap spraying. Developers mitigate this risk by implementing rigorous input validation, utilizing static analysis tools to detect unsafe memory access patterns, and adopting safer programming languages or libraries that enforce automatic bounds checking. Additionally, employing compiler protections like Address Sanitizer during development helps identify these errors early, ensuring that memory reads remain strictly within allocated limits to prevent unauthorized data exposure.

MITRE CWE Description

The product reads data past the end, or before the beginning, of the intended buffer.

Common Consequences (4)

Confidentiality Read Memory

An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.

Confidentiality Bypass Protection Mechanism

Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.

Availability DoS: Crash, Exit, or Restart

An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.

Other Varies by Context

The read operation could produce other undefined or unexpected results.

Mitigations (2)

Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…

Architecture and Design Use a language that provides appropriate memory abstractions.

Examples (2)

In the following code, the method retrieves a value from an array at a specific array index location that is given as an input parameter to the method

int getValueFromArray(int *array, int len, int index) { int value; // check that the array index is less than the maximum // length of the array if (index < len) { // get the value at the specified index of the array value = array[index]; } // if array index is invalid then output error message // and return value indicating error else { printf("Value is: %d\n", array[index]); value = -1; } return value; }

Bad · C

... // check that the array index is within the correct // range of values for the array if (index >= 0 && index < len) { ...

Good · C

In the following C/C++ example the method processMessageFromSocket() will get a message from a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains the message length and the message body. A for loop is used to copy the message body into a local character string which will be passed to another method for processing.

int processMessageFromSocket(int socket) { int success; char buffer[BUFFER_SIZE]; char message[MESSAGE_SIZE]; // get message from socket and store into buffer //Ignoring possibliity that buffer > BUFFER_SIZE if (getMessage(socket, buffer, BUFFER_SIZE) > 0) { // place contents of the buffer into message structure ExMessage *msg = recastBuffer(buffer); // copy message body into string for processing int index; for (index = 0; index < msg->msgLength; index++) { message[index] = msg->msgBody[index]; } message[index] = '\0'; // process message success = processMessage(message); } return success; }

Bad · C

CVE ID	Title	CVSS	Severity	Published
CVE-2026-116744	ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector — nDPI	5.3	Medium	2026-10-26
CVE-2026-116736	libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array — libpff	6.1	Medium	2026-10-26
CVE-2026-116733	flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number — flatcc	3.7	Low	2026-10-26
CVE-2026-116732	libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table — libdwarf	4.4	Medium	2026-10-26
CVE-2026-116730	Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import — furnace	5.5	Medium	2026-10-26
CVE-2026-116729	libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a — libfvde	3.3	Low	2026-10-26
CVE-2026-116728	libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x0024 — libfvde	5.5	Medium	2026-10-26
CVE-2026-116727	gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c — gbsplay	3.3	Low	2026-10-26
CVE-2026-116726	gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title — gbsplay	3.3	Low	2026-10-26
CVE-2026-116725	gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index — gbsplay	5.5	Medium	2026-10-26
CVE-2026-57184	Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon) — asterisk	6.3	Medium	2026-10-26
CVE-2026-116463	FastStone Image Viewer Box-Average Downsampler FUN_0062d96c out-of-bounds — Image Viewer	6.3	Medium	2026-10-26
CVE-2026-115920	ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank — onnx	6.2	Medium	2026-10-26
CVE-2026-115919	ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check) — onnx	6.2	Medium	2026-10-26
CVE-2026-115680	Keil MDK 8.0.0-8.3.0 DHCPv6 越界读取漏洞 — MDK-Middleware	-	-	2026-10-26
CVE-2026-116544	Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output — open5gs	3.7	Low	2026-10-26
CVE-2026-116487	NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read — mcuxsdk-middleware-usb	4.6	Medium	2026-10-26
CVE-2026-107157	Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework — Qt	2.0	Low	2026-10-26
CVE-2026-116261	libimobiledevice AFC File afc.c afc_file_open out-of-bounds — libimobiledevice	3.5	Low	2026-10-26
CVE-2026-82947	Multiple Out-of-Bounds Reads in Frame Processing — SOEM	7.1	High	2026-10-26
CVE-2026-82943	Out-of-Bounds Read via Unchecked Length Values — SOEM	6.5	Medium	2026-10-26
CVE-2026-107900	富士 V-SFT 越界读取漏洞致代码执行 — V-SFT	7.8	High	2026-10-26
CVE-2026-107899	富士 V-SFT 任意版本越界读取漏洞 — V-SFT	7.8	High	2026-10-26
CVE-2026-107898	富士 V-SFT 越界读取漏洞：信息泄露或代码执行 — V-SFT	7.8	High	2026-10-26
CVE-2026-107897	富士 V-SFT 存在越界读取漏洞，可致代码执行 — V-SFT	7.8	High	2026-10-26
CVE-2026-107896	富士 V-SFT 越界读取漏洞致代码执行 — V-SFT	7.8	High	2026-10-26
CVE-2026-116142	ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box — ImageMagick	3.3	Low	2026-10-25
CVE-2026-115801	Kakao khaiii JSON Config File Linear.cpp open out-of-bounds — khaiii	5.3	Medium	2026-10-23
CVE-2026-53920	odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure — odhcpd	8.7	High	2026-10-23
CVE-2026-115486	Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning — Red Hat Enterprise Linux 10	7.1	High	2026-10-23

Vulnerabilities classified as CWE-125 (跨界内存读) represent 4332 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.