CWE-125: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Consequences

• Confidentiality: Read Memory
• Confidentiality: Bypass Protection Mechanism
• Availability: DoS: Crash, Exit, or Restart
• Other: Varies by Context

How to prevent it

• Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright. To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
• Architecture and Design: Use a language that provides appropriate memory abstractions.

Recent advisories

• GHSA-9v9v-9qvf-h2hj — Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
• GHSA-v9pv-5gc8-w2m6 — Pillow multi-frame loaders can reuse stale native image storage after mode transitions
• GHSA-h3v5-h239-pg29 — Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
• GHSA-3qxv-5xgr-q7w9 — Electron: Frame subscription trusts GPU-supplied frame geometry
• GHSA-pchr-8j38-3x4p — Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
• GHSA-c6hw-5grf-ff96 — Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
• GHSA-f8qh-mqg4-9939 — Microsoft Security Advisory CVE-2026-96232 - .NET and Visual Studio Information Disclosure Vulnerability
• GHSA-26w7-cxv4-gfx2 — Astro: Remote code execution through AVIF image optimization
• GHSA-pfmc-3mgc-p6fp — Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
• GHSA-cq5v-8q36-5273 — AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
• GHSA-hwf3-r46v-5ggx — ImageMagick: Information Disclosure when printing profiles with debug enabled
• GO-2026-5942 — Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
• GHSA-62p4-gmf7-7g93 — Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
• GHSA-fj7v-r99m-22gq — Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
• GHSA-3m6q-jj5j-38c9 — Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input

All advisories for CWE-125