CWE-466 Return of Pointer Value Outside of Expected Range
baseA function can return a pointer to memory that is outside of the buffer that the pointer is expected to reference.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (15)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-10356US | high8.8 | — | ||
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code… | ||||
| CVE-2022-50320US | high7.8 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
ACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address
On a Packard Bell Dot SC (Intel At… | ||||
| CVE-2021-0188US | high7.8 | — | ||
Return of pointer value outside of expected range in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via l… | ||||
| CVE-2020-25767US | high7.5 | — | ||
An issue was discovered in HCC Embedded NicheStack IPv4 4.1. The dnc_copy_in routine for parsing DNS domain names does not check whether a domain name compression pointer is pointi… | ||||
| CVE-2024-21849US | high7.5 | — | ||
When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) proc… | ||||
| CVE-2022-36447US | high7.5 | — | ||
An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0. Previously minted tokens minted on the Chia blockchain using the CAT1 standard can be inflated to an arbitrar… | ||||
| CVE-2018-25234US | medium5.5 | — | ||
SmartFTP Client 9.0.2615.0 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Host field… | ||||
| CVE-2018-25227US | medium5.5 | — | ||
Valentina Studio 9.0.4 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Host field. At… | ||||
| CVE-2019-25586US | medium5.5 | — | ||
Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the URL field. Attackers ca… | ||||
| CVE-2019-25548US | medium5.5 | — | ||
BlueStacks 4.80.0.1060 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to the search field. Attackers… | ||||
| CVE-2026-57025US | — | — | ||
A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privilged attacker to… | ||||
| CVE-2019-25599US | — | — | ||
Backup Key Recovery 2.2.4 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field.… | ||||
| CVE-2022-50709US | — | — | ||
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
syzbot is reporting uninit value at ath9k_htc_rx_m… | ||||
| CVE-2024-33602US | — | — | ||
nscd: netgroup cache assumes NSS callback uses in-buffer strings
The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory
when the NSS callback does not store all… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan