CWE · MITRE source
CWE-126Buffer Over-read
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
Last updated: 16 October 2026 00:29 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
Prevent
Stop it (NIST 800-53 / CSF Protect)
SA-11Developer Testing and EvaluationID.RA-01PR.PS-02PR.PS-06
Detect
Catch it (CSF Detect / Respond)
—
Harden
Shrink the surface (DISA STIG)
—
Validate
Prove the fix (OWASP ASVS)
—
NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2017-7679 UPD | 9.1 | 9.8 | 0.3934 | 2017-06-20 |
CVE-2023-49285 UPD | 8.8 | 8.6 | 0.8814 | 2023-12-04 |
CVE-2023-36397 UPD | 8.5 | 9.8 | 0.1751 | 2023-11-14 |
CVE-2017-7668 UPD | 8.1 | 7.5 | 0.5747 | 2017-06-20 |
CVE-2018-14790 UPD | 8.0 | 9.8 | 0.0538 | 2018-10-01 |
CVE-2019-3563 UPD | 7.6 | 9.8 | 0.0171 | 2019-04-29 |
CVE-2019-11036 UPD | 7.6 | 9.1 | 0.0703 | 2019-05-03 |
CVE-2025-21277 UPD | 7.6 | 7.5 | 0.3861 | 2025-01-14 |
CVE-2024-20290 UPD | 7.5 | 7.5 | 0.3332 | 2024-02-07 |
CVE-2024-38071 UPD | 7.5 | 7.5 | 0.3585 | 2024-07-09 |
CVE-2017-17772 UPD | 7.2 | 9.8 | 0.0035 | 2024-11-26 |
CVE-2021-34584 UPD | 7.1 | 9.1 | 0.0111 | 2021-10-26 |
CVE-2023-51773 UPD | 7.1 | 9.1 | 0.0105 | 2024-02-29 |
CVE-2025-21176 UPD | 7.0 | 8.8 | 0.0235 | 2025-01-14 |
CVE-2024-38373 UPD | 6.9 | 9.6 | 0.0062 | 2024-06-24 |
CVE-2025-12106 UPD | 6.9 | 9.1 | 0.0056 | 2025-12-01 |
CVE-2009-2495 UPD | 6.8 | 6.5 | 0.3430 | 2009-07-29 |
CVE-2024-38265 UPD | 6.8 | 8.8 | 0.0142 | 2024-10-08 |
CVE-2025-55081 UPD | 6.8 | 9.1 | 0.0037 | 2025-10-15 |
CVE-2025-36855 UPD | 6.7 | 8.8 | 0.0077 | 2025-09-08 |
CVE-2018-8789 UPD | 6.5 | 7.5 | 0.0524 | 2018-11-29 |
CVE-2020-3399 UPD | 6.5 | 8.6 | 0.0136 | 2020-09-24 |
CVE-2021-1373 UPD | 6.5 | 8.6 | 0.0155 | 2021-03-24 |
CVE-2021-1588 UPD | 6.5 | 8.6 | 0.0132 | 2021-08-25 |
CVE-2022-20714 UPD | 6.5 | 8.6 | 0.0148 | 2022-04-15 |