Use of Out-of-range Pointer Offset
CWE-823
The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
The offset might be out-of-range if it comes from an untrusted source, is the result of an incorrect calculation, or occurs because of another error. If an attacker can control or influence the offset so that it points outside of the intended boundaries of the structure, then the attacker may be able to read or write to memory locations that are used elsewhere in the product. As a result, the attack might change the state of the product as accessed through program variables, cause a crash or instable behavior, and possibly lead to code execution.
We track 44 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.9. 1 has been exploited in real attacks.
Latest Use of Out-of-range Pointer Offset vulnerabilities
- 7.8 High severity
Snapdragon: Access of Resource Using Incompatible Type
The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
- 7.5 High severity
uC-FTPs: Out-of-bounds Read
An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulne
- 7.5 High severity
uC-FTPs: Out-of-bounds Read
An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulne
- 7.8 High severity
vGPU software (guest driver) - Linux, vGPU…: Improper Restriction of Operations within the Bounds of a Memory Buffer
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause the use of an out-of-range pointer offset, which may lead to data tampering, data loss, information disclosure, or denial of ser