CWE-125 Out-of-bounds Read Analysis: Impact, Fix, and POC Examples

Vulnerability Overview CWE-125: Out-of-bounds Read Description: The product reads data beyond the boundaries of an expected buffer, specifically reading data before the start of or after the end of the buffer. Aliases: OOB read (abbreviation for "Out of bounds" read) Impact Scope Confidentiality: Attackers can obtain sensitive information, such as encryption keys, Personally Identifiable Information (PII), memory addresses, etc. Integrity: Buffers may contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms, thereby improving the reliability of exploiting other code execution vulnerabilities. Availability: Attackers may cause segmentation faults or crashes due to reading memory beyond buffer boundaries. This is particularly likely when code reads a variable amount of data and assumes the presence of a sentinel (such as a NUL character in a string) to stop the read operation. Other: Read operations may produce other undefined or unexpected results. Remediation Input Validation: Adopt an "accept known good" input validation strategy, which involves strictly conforming to specifications using a list of acceptable inputs. Reject any input that does not conform to specifications, or convert it into input that conforms to specifications. Language Selection: Use languages that provide appropriate memory abstractions. POC Code Example Example 1 Issue: This method only verifies that the given array index is less than the maximum length of the array but does not check the minimum value (CWE-839). This could allow negative values to be accepted as input array indices, leading to data reads before the start of the buffer (CWE-127) and potentially allowing access to sensitive memory. Remediation: Example 2 Issue: The message length variable ( ) is used for the loop termination condition but is not verified to accurately reflect the actual length of the message body (CWE-606). If indicates a length greater than the actual size of the message body (CWE-130), it could lead to a buffer over-read (CWE-125). Related Vulnerabilities CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-126: Buffer Over-read CWE-127: Buffer Under-read CWE-823: Use of Uninitialized Pointer CWE-824: Access of Uninitialized Pointer CWE-825: Expired Pointer Dereference Applicable Platforms Languages: C (likely prevalent), C++ (likely prevalent) Technologies: JCS/OT (often prevalent) Detection Techniques Fuzzing: Fuzzing is a powerful technique for generating a large number of different inputs to dynamically invoke code, either randomly or algorithmically. Even with random inputs, it can produce unexpected results, such as crashes, memory corruption, or resource exhaustion. Fuzzing effectively produces repeatable test cases that clearly indicate errors, helping developers diagnose problems. Automated Static Analysis: Automated static analysis, often referred to as Static Application Security Testing (SAST), can identify instances of these weaknesses by analyzing source code (or binaries/compiled code) without executing it. This is typically done by building data flow and control flow models and then searching for potentially vulnerable patterns that connect "sources" (origins of input) to "sinks" (locations where data interacts with external components, such as lower-level code like the OS). Automated Dynamic Analysis: Tools integrated into the compilation process to insert runtime error-checking mechanisms, such as AddressSanitizer (ASan) for C/C++ (REF-1518). Functional Areas Memory Management Affected Resources Memory Relationships SFP Secondary Cluster: Faulty Buffer Access SEI CERT C Coding Standard - Guidelines 03. Expressions (EXP) SEI CERT C Coding Standard - Guidelines 06. Arrays (ARR) SEI CERT C Coding Standard - Guidelines 07. Characters and Strings (STR) 2019 CWE Top 25 Most Dangerous Software Errors 2021 CWE Top 25 Most Dangerous Software Weaknesses 2020 CWE Top 25 Most Dangerous Software Weaknesses ICS Communications: Frail Security in Protocols 2022 CWE Top 25 Most Dangerous Software Weaknesses Comprehensive Categorization: Memory Safety 2023 CWE Top 25 Most Dangerous Software Weaknesses 2024 CWE Top 25 Most Dangerous Software Weaknesses 2025 CWE Top 25 Most Dangerous Software Weaknesses Vulnerability Mapping Notes Usage: Allowed (This CWE ID can be used to map to real-world vulnerabilities) Reason: Acceptable usage Justification: This CWE entry is at the basic abstraction level, which is the preferred abstraction level for mapping to the root cause of vulnerabilities. Comment: Read the name and description carefully to ensure the mapping is appropriate. Do not attempt to "force" the mapping to lower-level base/variate variants to fit this preferred abstraction level. Classification Mappings PLOVER: Out-of-bounds Read CERT C Secure Coding: ARR30-C, ARR38-C, EXP39-C, STR31-C, STR32-C Software Fault Patterns: SFP8 Related Attack Patterns CAPEC-540: Overr

Goal Reached Thanks to every supporter — we hit 100%!

CWE-125 Out-of-bounds Read Analysis: Impact, Fix, and POC Examples