334
Nature Type ID Name Page
MemberOf 1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous
Software Weaknesses
1425 2600
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Out-of-bounds Read
CERT C Secure Coding ARR30-
C
Imprecise Do not form or use out-of-bounds
pointers or array subscripts
CERT C Secure Coding ARR38-
C
Imprecise Guarantee that library functions do not
form invalid pointers
CERT C Secure Coding EXP39-C Imprecise Do not access a variable through a
pointer of an incompatible type
CERT C Secure Coding STR31-C Imprecise Guarantee that storage for strings has
sufficient space for character data and
the null terminator
CERT C Secure Coding STR32-C CWE More
Abstract
Do not pass a non-null-terminated
character sequence to a library function
that expects a string
Software Fault Patterns SFP8 Faulty Buffer Access
Related Attack Patterns
CAPEC-ID Attack Pattern Name
540 Overread Buffers
References
[REF-1034]Raoul Strackx, Yves Younan, Pieter Philippaerts, Frank Piessens, Sven Lachmund
and Thomas Walter. "Breaking the memory secrecy assumption". 2009 March 1. ACM. < https://
dl.acm.org/doi/10.1145/1519144.1519145 >.2023-04-07.
[REF-1035]Fermin J. Serna. "The info leak era on software exploitation". 2012 July 5. < https://
media.blackhat.com/bh-us-12/Briefings/Serna/BH_US_12_Serna_Leak_Era_Slides.pdf >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-126: Buffer Over-read
Weakness ID : 126
Structure : Simple
Abstraction : Variant
Description
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that
reference memory locations after the targeted buffer.
Extended Description
This typically occurs when the pointer or its index is incremented to a position beyond the bounds
of the buffer or when pointer arithmetic results in a position outside of the valid memory location to
name a few. This may result in exposure of sensitive information or possibly a crash.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
CWE Version 4.14
CWE-126: Buffer Over-read
CWE-126: Buffer Over-read