CWE Top 25 2025, rank 8CWE-125
Out-of-bounds Read
CWE-125: Out-of-bounds Read
An out-of-bounds read happens when code reads data past the end, or before the start, of a buffer. The result is usually disclosure of adjacent memory, which can include keys, passwords, session data, or pointer values that help an attacker defeat ASLR for a follow-on exploit. It can also crash the process. Heartbleed in OpenSSL is the textbook case: the server trusted a length field in a heartbeat request and returned up to 64 KB of its own memory.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- A TLS heartbeat handler copies as many bytes as the client claims to have sent, leaking private keys and session data from process memory.
- A font or media parser reads a table offset from the file without checking it against the file length.
- A string routine reads past a buffer that was never null-terminated.
How to mitigate it
- Validate every length, offset, and index from untrusted input against the real size of the buffer before reading.
- Prefer memory-safe languages or bounds-checked containers and accessors.
- Fuzz file and protocol parsers with sanitizers enabled to detect reads past allocation boundaries.
- Keep secrets in separate, short-lived memory regions and clear them after use to limit what a leak can expose.
Go deeper
Practice this topic
Test your knowledge of Out-of-bounds Read with exam-style practice questions.