CWE-788 147 件の CVE MITRE の定義 ↗

CWE-788: Access of Memory Location After End of Buffer

概要

CWE-788(Access of Memory Location After End of Buffer)は各種脆弱性データベースや評価で用いられる弱点タイプを説明します。定義・背景・対応する CVE は以下の各セクションを参照してください。

セキュリティへの影響
セキュリティ影響:製品や文脈に依存します。CVE 記録、深刻度、MITRE の説明を参照して優先度を判断してください。

説明

The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.

適用プラットフォーム

種別 名称 クラス 普遍性 OS / CPE
language Memory-Unsafe Undetermined
language C Often
language C++ Often

このデータベースの関連 CVE

これらの CVE は本データベースでこの弱点に対応付けられており、追跡と検索のために保持されています。

CVE 公開 概要
CVE-2023-20585 2026-04-16 Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds condition without RMP checks, resulting in …
CVE-2026-20052 2026-03-04 A vulnerability in the memory management handling for the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the S…
CVE-2026-21316 2026-02-10 Audition versions 25.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to application denial-of-service. An attacker could exploit this vulne…
CVE-2026-25584 2026-02-04 iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a stack-buffer-overflow …
CVE-2025-36581 2025-08-14 Dell PowerEdge Platform version(s) 14G AMD BIOS v1.25.0 and prior, contain(s) an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentia…
CVE-2025-43580 2025-07-08 Audition versions 25.2, 24.6.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could result in application denial-of-service. An attacker could leverage…
CVE-2024-20402 2024-10-23 A vulnerability in the SSL VPN feature for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a…
CVE-2024-20330 2024-10-23 A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remo…
CVE-2024-42425 2024-09-10 Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exp…
CVE-2024-38304 2024-08-29 Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potential…
CVE-2024-5700 2024-06-11 Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these coul…
CVE-2024-27828 2024-06-10 The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be able to execute arbitrary code with kernel …
CVE-2024-27829 2024-05-14 The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.5. Processing a file may lead to unexpected app termination or arbitrary code execution.
CVE-2024-21618 2024-04-12 An Access of Memory Location After End of Buffer vulnerability in the Layer-2 Control Protocols Daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated att…
CVE-2024-0074 2024-03-27 NVIDIA GPU Display Driver for Linux contains a vulnerability where an attacker may access a memory location after the end of the buffer. A successful exploit of this vulnerability may lead to denial o…
CVE-2024-0173 2024-03-13 Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could potentially exploit this vulnerability to read…
CVE-2024-0154 2024-03-13 Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could potentially exploit this vulnerability to read…
CVE-2023-38570 2023-11-14 Access of memory location after end of buffer for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-20169 2023-08-23 A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco NX-OS Software for the Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone N…
CVE-2023-22297 2023-05-10 Access of memory location after end of buffer in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local access.

コンテンツ投稿

名称
CWE Content Team
組織
MITRE
日付
2009-10-21
バージョン
1.6

コンテンツの変更履歴

日付 名称 バージョン 重要度 コメント
2011-06-01 CWE Content Team 1.13 updated Common_Consequences
2012-05-11 CWE Content Team 2.2 updated Common_Consequences, Demonstrative_Examples, Observed_Examples, Relationships
2013-02-21 CWE Content Team 2.4 updated Demonstrative_Examples
2014-06-23 CWE Content Team 2.7 updated Demonstrative_Examples
2015-12-07 CWE Content Team 2.9 updated Description
2017-05-03 CWE Content Team 2.11 updated Description
2017-11-08 CWE Content Team 3.0 updated Common_Consequences, Demonstrative_Examples, Observed_Examples
2019-01-03 CWE Content Team 3.2 updated References, Relationships, Taxonomy_Mappings
2020-02-24 CWE Content Team 4.0 updated Relationships
2020-06-25 CWE Content Team 4.1 updated Demonstrative_Examples
2020-08-20 CWE Content Team 4.2 updated Relationships
2020-12-10 CWE Content Team 4.3 updated Relationships
2021-07-20 CWE Content Team 4.5 updated Demonstrative_Examples
2022-04-28 CWE Content Team 4.7 updated Description
2023-01-31 CWE Content Team 4.10 updated Description
2023-04-27 CWE Content Team 4.11 updated Detection_Factors, Relationships
2023-06-29 CWE Content Team 4.12 updated Mapping_Notes
2024-07-16 CWE Content Team 4.15 updated Common_Consequences
2025-04-03 CWE Content Team 4.17 updated Applicable_Platforms
2025-09-09 CWE Content Team 4.18 updated Affected_Resources, Demonstrative_Examples, Functional_Areas
2025-12-11 CWE Content Team 4.19 updated Applicable_Platforms, Detection_Factors, References, Time_of_Introduction, Weakness_Ordinalities

貢献

タイプ 名称 日付 コメント
Feedback Eric Constantin Brinz 2022-02-23 Suggested corrections to extended description.
cvelogic Threat Intelligence