← Back
CWE-125

9,090 CVEs • Abstraction: Base

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

JSON object

Loading...

CVEs (9,090)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2011-2858
1Google
1Chrome
Apr 29, 2026
Sep 19, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Google Chrome before 14.0.835.163 does not properly handle triangle arrays, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-2851
1Google
1Chrome
Apr 29, 2026
Sep 19, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Google Chrome before 14.0.835.163 does not properly handle video, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-2850
1Google
1Chrome
Apr 29, 2026
Sep 19, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Google Chrome before 14.0.835.163 does not properly handle Khmer characters, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-2844
1Google
1Chrome
Apr 29, 2026
Sep 19, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Google Chrome before 14.0.835.163 does not properly process MP3 files, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-2843
1Google
1Chrome
Apr 29, 2026
Sep 19, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Google Chrome before 14.0.835.163 does not properly handle media buffers, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-2803
1Google
1Chrome
Apr 29, 2026
Aug 3, 2011
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Google Chrome before 13.0.782.107 does not properly handle Skia paths, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-2794
1Google
1Chrome
Apr 29, 2026
Aug 3, 2011
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Google Chrome before 13.0.782.107 does not properly perform text iteration, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-2501
4Canonical
DebianFedoraproject+1 more
4Debian Linux
FedoraLibpng+1 more
Apr 29, 2026
Jul 17, 2011
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 allows remote attackers to cause a denial of service (application crash) via a c...Show more
The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 allows remote attackers to cause a denial of service (application crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message data. NOTE: this vulnerability exists because of a CVE-2004-0421 regression. NOTE: this is called an off-by-one error by some sources.Show less
CVE-2011-2345
1Google
1Chrome
Apr 29, 2026
Jun 29, 2011
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The NPAPI implementation in Google Chrome before 12.0.742.112 does not properly handle strings, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-1455
1Google
1Chrome
Apr 29, 2026
May 3, 2011
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Google Chrome before 11.0.696.57 does not properly handle PDF documents with multipart encoding, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted document.
CVE-2011-1445
1Google
1Chrome
Apr 29, 2026
May 3, 2011
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Google Chrome before 11.0.696.57 does not properly handle SVG documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-1192
1Google
1Chrome
Apr 29, 2026
Mar 11, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Google Chrome before 10.0.648.127 on Linux does not properly handle Unicode ranges, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-1122
1Google
1Chrome
Apr 29, 2026
Mar 1, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The WebGL implementation in Google Chrome before 9.0.597.107 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, aka Issue 71960.
CVE-2011-1120
1Google
1Chrome
Apr 29, 2026
Mar 1, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The WebGL implementation in Google Chrome before 9.0.597.107 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, aka Issue 71717.
CVE-2011-1113
1Google
1Chrome
Apr 29, 2026
Mar 1, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Google Chrome before 9.0.597.107 on 64-bit Linux platforms does not properly perform pickle deserialization, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-0984
2Debian
Google
2Chrome
Debian Linux
Apr 29, 2026
Feb 10, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Google Chrome before 9.0.597.94 does not properly handle plug-ins, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2010-4577
4Debian
FedoraprojectGoogle+1 more
5Chrome
Chrome OsDebian Linux+2 more
Apr 29, 2026
Dec 22, 2010
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly par...Show more
The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted local font, related to "Type Confusion."Show less
CVE-2009-2523
1Microsoft
1Windows 2000
Apr 23, 2026
Nov 11, 2009
N/A· v4
N/A· v3
10.0 HIGH· v2
The License Logging Server (llssrv.exe) in Microsoft Windows 2000 SP4 allows remote attackers to execute arbitrary code via an RPC message containing a string without a null terminator, which triggers a heap-based buffer...Show more
The License Logging Server (llssrv.exe) in Microsoft Windows 2000 SP4 allows remote attackers to execute arbitrary code via an RPC message containing a string without a null terminator, which triggers a heap-based buffer overflow in the LlsrLicenseRequestW method, aka "License Logging Server Heap Overflow Vulnerability."Show less
CVE-2007-3847
3Apache
CanonicalFedoraproject
4Fedora
Fedora CoreHttp Server+1 more
Apr 23, 2026
Aug 23, 2007
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted dat...Show more
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.Show less
CVE-2006-6016
1Wordpress
1Wordpress
Apr 23, 2026
Nov 21, 2006
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified user_id parameter.