330
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-125: Out-of-bounds Read
Weakness ID : 125
Structure : Simple
Abstraction : Base
Description
The product reads data past the end, or before the beginning, of the intended buffer.
Extended Description
Typically, this can allow attackers to read sensitive information from other memory locations or
cause a crash. A crash can occur when the code reads a variable amount of data and assumes
that a sentinel exists to stop the read operation, such as a NUL in a string. The expected sentinel
might not be located in the out-of-bounds memory, causing excessive data to be read, leading
to a segmentation fault or a buffer overflow. The product may modify an index or perform pointer
arithmetic that references a memory location that is outside of the boundaries of the buffer. A
subsequent read operation then produces undefined or unexpected results.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 119 Improper Restriction of Operations within the Bounds of a
Memory Buffer