Out-of-bounds read
Reading memory before the start or past the end of a buffer (CWE-125), which can disclose secrets such as private keys or reveal memory layout that helps another exploit; Heartbleed (CVE-2014-0160) was one.
- Also called
- buffer over-read
- Defined in
- MITRE CWE-125
- Identifiers
- CWE-125: Out-of-bounds read
Covered in
Find, fix and contain memory-safety bugs in C and C++
Recognize out-of-bounds access, use after free, NULL dereference and integer overflow in C and C++, fix them with checked lengths and single ownership, harden release builds, catch the rest with sanitizers and fuzzing, and plan new code in a memory-safe language.
Case study: CrowdStrike Channel File 291 (July 2024)
How a CrowdStrike content update crashed Windows hosts in July 2024: a field-count mismatch hidden by wildcard tests, a missing bounds check, and no staged rollout.
Fuzz a parser and turn crashes into lasting regressions
Build a narrow harness, observe memory and resource failures, minimize the input, and test the repaired parser.
Case study: Citrix Bleed (CVE-2023-4966)
How a NetScaler memory over-read leaked session cookies that bypassed passwords and MFA in 2023, why patching did not end hijacked sessions, and how the pattern returned in 2025.
Practice: Buffer over-read lab: Stop a heartbeat over-read · Local project: Parse bounded JSON and XML invoices safely · Local project: Repair a native parser using sanitizer evidence