CWE-125

The product reads data past the end, or before the beginning, of the intended buffer.

Common consequences

• Confidentiality → Read Memory
• Confidentiality → Bypass Protection Mechanism
• Availability → DoS: Crash, Exit, or Restart
• Other → Varies by Context

Mitigations

• Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input
• Architecture and Design: Use a language that provides appropriate memory abstractions.