560 vulnerabilities classified as CWE-126 (缓冲区上溢读取). AI Chinese analysis included.
CWE-126, Buffer Over-read, is a memory safety weakness where a software component reads data from memory locations beyond the allocated boundaries of a target buffer. This vulnerability typically arises when developers fail to validate array indices or pointer arithmetic, allowing an attacker to access sensitive information stored in adjacent memory regions. Exploitation often leads to information disclosure, where attackers extract confidential data such as cryptographic keys or user credentials, or potentially trigger denial-of-service conditions by causing application crashes. To mitigate this risk, developers must rigorously enforce bounds checking on all buffer access operations, ensuring that read indices remain within the valid memory range. Utilizing safe programming languages with automatic memory management and employing static analysis tools during the development lifecycle can further help detect and prevent these out-of-bounds read errors before deployment.
int processMessageFromSocket(int socket) { int success; char buffer[BUFFER_SIZE]; char message[MESSAGE_SIZE]; // get message from socket and store into buffer //Ignoring possibliity that buffer > BUFFER_SIZE if (getMessage(socket, buffer, BUFFER_SIZE) > 0) { // place contents of the buffer into message structure ExMessage *msg = recastBuffer(buffer); // copy message body into string for processing int index; for (index = 0; index < msg->msgLength; index++) { message[index] = msg->msgBody[index]; } message[index] = '\0'; // process message success = processMessage(message); } return success; }int main(int argc, char **argv) { char Filename[256]; char Pattern[32]; /* Validate number of parameters and ensure valid content */ ... /* copy filename parameter to variable, may cause off-by-one overflow */ strncpy(Filename, argv[1], sizeof(Filename)); /* copy pattern parameter to variable, may cause off-by-one overflow */ strncpy(Pattern, argv[2], sizeof(Pattern)); printf("Searching file: %s for the pattern: %s\n", Filename, Pattern); Scan_File(Filename, Pattern); }/* copy filename parameter to variable, no off-by-one overflow */ strncpy(Filename, argv[2], sizeof(Filename)-1); Filename[255]='\0'; /* copy pattern parameter to variable, no off-by-one overflow */ strncpy(Pattern, argv[3], sizeof(Pattern)-1); Pattern[31]='\0';Vulnerabilities classified as CWE-126 (缓冲区上溢读取) represent 560 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.