CWE-788 147 CVEs MITRE definition ↗

CWE-788: Access of Memory Location After End of Buffer

Overview

CWE-788 (Access of Memory Location After End of Buffer) documents a weakness type used across vulnerability databases and security assessments. Use the sections below for definition, context, and mapped CVEs.

Security impact
Security impact: Depends on product and context; use CVE records, severity scores, and MITRE guidance to prioritize.

Description

The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.

Applicable platforms

Kind Name Class Prevalence OS / CPE
language Memory-Unsafe Undetermined
language C Often
language C++ Often

Related CVEs in this database

These CVEs are mapped to this weakness in this database and kept for traceability and search.

CVE Published Summary
CVE-2023-20585 2026-04-16 Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds condition without RMP checks, resulting in …
CVE-2026-20052 2026-03-04 A vulnerability in the memory management handling for the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the S…
CVE-2026-21316 2026-02-10 Audition versions 25.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to application denial-of-service. An attacker could exploit this vulne…
CVE-2026-25584 2026-02-04 iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a stack-buffer-overflow …
CVE-2025-36581 2025-08-14 Dell PowerEdge Platform version(s) 14G AMD BIOS v1.25.0 and prior, contain(s) an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentia…
CVE-2025-43580 2025-07-08 Audition versions 25.2, 24.6.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could result in application denial-of-service. An attacker could leverage…
CVE-2024-20402 2024-10-23 A vulnerability in the SSL VPN feature for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a…
CVE-2024-20330 2024-10-23 A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remo…
CVE-2024-42425 2024-09-10 Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exp…
CVE-2024-38304 2024-08-29 Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potential…
CVE-2024-5700 2024-06-11 Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these coul…
CVE-2024-27828 2024-06-10 The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be able to execute arbitrary code with kernel …
CVE-2024-27829 2024-05-14 The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.5. Processing a file may lead to unexpected app termination or arbitrary code execution.
CVE-2024-21618 2024-04-12 An Access of Memory Location After End of Buffer vulnerability in the Layer-2 Control Protocols Daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated att…
CVE-2024-0074 2024-03-27 NVIDIA GPU Display Driver for Linux contains a vulnerability where an attacker may access a memory location after the end of the buffer. A successful exploit of this vulnerability may lead to denial o…
CVE-2024-0173 2024-03-13 Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could potentially exploit this vulnerability to read…
CVE-2024-0154 2024-03-13 Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could potentially exploit this vulnerability to read…
CVE-2023-38570 2023-11-14 Access of memory location after end of buffer for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-20169 2023-08-23 A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco NX-OS Software for the Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone N…
CVE-2023-22297 2023-05-10 Access of memory location after end of buffer in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local access.

Content submission

Name
CWE Content Team
Organization
MITRE
Date
2009-10-21
Version
1.6

Content modifications

Date Name Version Importance Comment
2011-06-01 CWE Content Team 1.13 updated Common_Consequences
2012-05-11 CWE Content Team 2.2 updated Common_Consequences, Demonstrative_Examples, Observed_Examples, Relationships
2013-02-21 CWE Content Team 2.4 updated Demonstrative_Examples
2014-06-23 CWE Content Team 2.7 updated Demonstrative_Examples
2015-12-07 CWE Content Team 2.9 updated Description
2017-05-03 CWE Content Team 2.11 updated Description
2017-11-08 CWE Content Team 3.0 updated Common_Consequences, Demonstrative_Examples, Observed_Examples
2019-01-03 CWE Content Team 3.2 updated References, Relationships, Taxonomy_Mappings
2020-02-24 CWE Content Team 4.0 updated Relationships
2020-06-25 CWE Content Team 4.1 updated Demonstrative_Examples
2020-08-20 CWE Content Team 4.2 updated Relationships
2020-12-10 CWE Content Team 4.3 updated Relationships
2021-07-20 CWE Content Team 4.5 updated Demonstrative_Examples
2022-04-28 CWE Content Team 4.7 updated Description
2023-01-31 CWE Content Team 4.10 updated Description
2023-04-27 CWE Content Team 4.11 updated Detection_Factors, Relationships
2023-06-29 CWE Content Team 4.12 updated Mapping_Notes
2024-07-16 CWE Content Team 4.15 updated Common_Consequences
2025-04-03 CWE Content Team 4.17 updated Applicable_Platforms
2025-09-09 CWE Content Team 4.18 updated Affected_Resources, Demonstrative_Examples, Functional_Areas
2025-12-11 CWE Content Team 4.19 updated Applicable_Platforms, Detection_Factors, References, Time_of_Introduction, Weakness_Ordinalities

Contributions

Type Name Date Comment
Feedback Eric Constantin Brinz 2022-02-23 Suggested corrections to extended description.
cvelogic Threat Intelligence