Cyber Resilience

CWE · MITRE source

CWE-125Out-of-bounds Read

Abstraction: Base · CVEs in our corpus: 8,913

The product reads data past the end, or before the beginning, of the intended buffer.

Last updated: 04 July 2026 00:28 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 6 mapping(s) from 2 framework(s): ATT&CK 5 (partial) · CAPEC 1 (partial)

See the full cumulative-coverage rollup →

NIST 800-53 r5 controls that address this weakness (0)AI

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial).

T1068 Exploitation for Privilege Escalation←P →PT1190 Exploit Public-Facing Application←P →PT1203 Exploitation for Client Execution←P →PT1210 Exploitation of Remote Services←P →PT1211 Exploitation for Stealth→PT1212 Exploitation for Credential Access←P →P

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2014-0160 KEV10.07.51.00002014-04-07
CVE-2016-1646 KEV10.08.80.48112016-03-29
CVE-2016-4523 KEV10.07.50.31392016-06-09
CVE-2017-5030 KEV10.08.80.41602017-04-24
CVE-2020-11899 KEV10.05.40.18562020-06-17
CVE-2021-25487 KEV10.07.30.00622021-10-06
CVE-2021-4034 KEV10.07.80.94922022-01-28
CVE-2022-22674 KEV10.05.50.01132022-05-26
CVE-2023-28204 KEV10.06.50.14412023-06-23
CVE-2023-36424 KEV10.07.80.12182023-11-14
CVE-2023-42916 KEV10.06.50.17962023-11-30
CVE-2024-0519 KEV10.08.80.03772024-01-16
CVE-2024-53150 KEV10.07.10.01322024-12-24
CVE-2025-22226 KEV10.07.10.01682025-03-04
CVE-2025-24991 KEV10.05.50.01852025-03-11
CVE-2025-5419 KEV UPD10.08.80.06462025-06-03
CVE-2025-5777 KEV UPD10.07.50.99902025-06-17
CVE-2026-3055 KEV10.09.80.84002026-03-23
CVE-2026-11645 KEV UPD10.08.80.01652026-06-09
CVE-2004-01848.00.00.60352004-05-04
CVE-2017-37318.07.50.57592017-05-04
CVE-2017-76688.07.50.57472017-06-20
CVE-2017-37378.05.90.78672017-12-07
CVE-2018-07678.05.30.65472018-01-04
CVE-2018-07808.05.30.58572018-01-04