CWE · MITRE source
CWE-125Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Last updated: 16 October 2026 07:24 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
Prevent
Stop it (NIST 800-53 / CSF Protect)
ID.RA-01PR.PS-02PR.PS-06SA-11Developer Testing and Evaluation
Detect
Catch it (CSF Detect / Respond)
—
Harden
Shrink the surface (DISA STIG)
—
Validate
Prove the fix (OWASP ASVS)
—
NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2020-8794 UPD | 9.9 | 9.8 | 0.8890 | 2020-02-25 |
CVE-2026-3055 KEV UPD | 9.9 | 9.8 | 0.0404 | 2026-03-23 |
CVE-2020-25107 UPD | 9.4 | 9.8 | 0.5370 | 2020-12-11 |
CVE-2020-25109 UPD | 9.4 | 9.8 | 0.5370 | 2020-12-11 |
CVE-2020-25110 UPD | 9.4 | 9.8 | 0.5370 | 2020-12-11 |
CVE-2019-6443 UPD | 9.3 | 9.1 | 0.6688 | 2019-01-16 |
CVE-2016-1646 KEV UPD | 9.2 | 8.8 | 0.4811 | 2016-03-29 |
CVE-2017-5030 KEV UPD | 9.2 | 8.8 | 0.4063 | 2017-04-24 |
CVE-2019-8457 UPD | 9.2 | 9.8 | 0.4543 | 2019-05-30 |
CVE-2019-19307 UPD | 9.2 | 9.8 | 0.4225 | 2019-11-26 |
CVE-2024-0519 KEV UPD | 9.2 | 8.8 | 0.0380 | 2024-01-16 |
CVE-2025-5419 KEV UPD | 9.2 | 8.8 | 0.0782 | 2025-06-03 |
CVE-2026-11645 KEV UPD | 9.2 | 8.8 | 0.0244 | 2026-06-09 |
CVE-2021-44142 UPD | 9.1 | 8.8 | 0.7359 | 2022-02-21 |
CVE-2024-26594 UPD | 8.9 | 9.1 | 0.5125 | 2024-02-23 |
CVE-2019-6444 UPD | 8.8 | 9.1 | 0.4572 | 2019-01-16 |
CVE-2023-49285 UPD | 8.8 | 8.6 | 0.8814 | 2023-12-04 |
CVE-2021-25216 UPD | 8.7 | 8.1 | 0.8237 | 2021-04-29 |
CVE-2024-29943 UPD | 8.6 | 9.8 | 0.2293 | 2024-03-22 |
CVE-2014-0160 KEV UPD | 8.5 | 7.5 | 1.0000 | 2014-04-07 |
CVE-2016-4523 KEV UPD | 8.5 | 7.5 | 0.3117 | 2016-06-09 |
CVE-2021-20093 UPD | 8.5 | 9.1 | 0.3330 | 2021-06-16 |
CVE-2021-4034 KEV UPD | 8.5 | 7.8 | 0.9492 | 2022-01-28 |
CVE-2023-36424 KEV UPD | 8.5 | 7.8 | 0.1209 | 2023-11-14 |
CVE-2025-5777 KEV UPD | 8.5 | 7.5 | 0.9997 | 2025-06-17 |