CWE-823
Use of Out-of-range Pointer Offset
Description
The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
Hierarchy (View 1000)
Parents
Children
none
Related attack patterns (CAPEC)
CAPEC-129
CVEs mapped to this weakness (101)
page 2 of 6| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-27009 | Hig | 0.53 | 8.1 | 0.07 | Apr 22, 2021 | A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All… | ||
| CVE-2026-46244 | Cri | 0.52 | 9.1 | 0.00 | Jun 3, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers,… | ||
| CVE-2020-6112 | Hig | 0.52 | 7.8 | 0.17 | Sep 17, 2020 | An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when decoding sub-samples. While initializing tiles with sub-sample data, the application can miscalculate a pointer for the stripes… | ||
| CVE-2026-49745 | Hig | 0.51 | 7.8 | 0.00 | Jul 24, 2026 | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds… | ||
| CVE-2026-49744 | Hig | 0.51 | 7.8 | 0.00 | Jul 24, 2026 | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation… | ||
| CVE-2026-28764 | Hig | 0.51 | 7.8 | 0.00 | May 21, 2026 | MediaArea MediaInfoLib LXF element parsing heap-based buffer overflow vulnerability | ||
| CVE-2025-47349 | Hig | 0.51 | 7.8 | 0.00 | Oct 9, 2025 | Memory corruption while processing an escape call. | ||
| CVE-2025-25180 | Hig | 0.51 | 7.8 | 0.00 | Jul 14, 2025 | Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages… | ||
| CVE-2024-45557 | Hig | 0.51 | 7.8 | 0.00 | Apr 7, 2025 | Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation. | ||
| CVE-2024-43060 | Hig | 0.51 | 7.8 | 0.00 | Mar 3, 2025 | Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP. | ||
| CVE-2024-52939 | Hig | 0.51 | 7.8 | 0.00 | Feb 22, 2025 | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write data outside the Guest's virtualised GPU memory. | ||
| CVE-2024-49840 | Hig | 0.51 | 7.8 | 0.00 | Feb 3, 2025 | Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality. | ||
| CVE-2024-45573 | Hig | 0.51 | 7.8 | 0.00 | Feb 3, 2025 | Memory corruption may occour while generating test pattern due to negative indexing of display ID. | ||
| CVE-2024-47900 | — | Hig | 0.51 | 7.8 | 0.00 | Jan 31, 2025 | Software installed and run as a non-privileged user may conduct improper GPU system calls to access OOB kernel memory. | |
| CVE-2024-52938 | Hig | 0.51 | 7.8 | 0.00 | Jan 13, 2025 | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to subvert reconstruction activities to trigger a write of data outside the Guest's virtualised GPU memory. | ||
| CVE-2024-21475 | Hig | 0.51 | 7.8 | 0.00 | May 6, 2024 | Memory corruption when the payload received from firmware is not as per the expected protocol size. | ||
| CVE-2023-43516 | Hig | 0.51 | 7.8 | 0.00 | Feb 6, 2024 | Memory corruption when malformed message payload is received from firmware. | ||
| CVE-2023-43513 | Hig | 0.51 | 7.8 | 0.00 | Feb 6, 2024 | Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element. | ||
| CVE-2023-33110 | Hig | 0.51 | 7.8 | 0.00 | Jan 2, 2024 | The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption. | ||
| CVE-2023-33079 | Hig | 0.51 | 7.8 | 0.00 | Dec 5, 2023 | Memory corruption in Audio while running invalid audio recording from ADSP. |
- risk 0.53cvss 8.1epss 0.07
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All…
- risk 0.52cvss 9.1epss 0.00
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers,…
- risk 0.52cvss 7.8epss 0.17
An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when decoding sub-samples. While initializing tiles with sub-sample data, the application can miscalculate a pointer for the stripes…
- risk 0.51cvss 7.8epss 0.00
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds…
- risk 0.51cvss 7.8epss 0.00
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation…
- risk 0.51cvss 7.8epss 0.00
MediaArea MediaInfoLib LXF element parsing heap-based buffer overflow vulnerability
- risk 0.51cvss 7.8epss 0.00
Memory corruption while processing an escape call.
- risk 0.51cvss 7.8epss 0.00
Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages…
- risk 0.51cvss 7.8epss 0.00
Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation.
- risk 0.51cvss 7.8epss 0.00
Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.
- risk 0.51cvss 7.8epss 0.00
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write data outside the Guest's virtualised GPU memory.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality.
- risk 0.51cvss 7.8epss 0.00
Memory corruption may occour while generating test pattern due to negative indexing of display ID.
- risk 0.51cvss 7.8epss 0.00
Software installed and run as a non-privileged user may conduct improper GPU system calls to access OOB kernel memory.
- risk 0.51cvss 7.8epss 0.00
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to subvert reconstruction activities to trigger a write of data outside the Guest's virtualised GPU memory.
- risk 0.51cvss 7.8epss 0.00
Memory corruption when the payload received from firmware is not as per the expected protocol size.
- risk 0.51cvss 7.8epss 0.00
Memory corruption when malformed message payload is received from firmware.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
- risk 0.51cvss 7.8epss 0.00
The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.
- risk 0.51cvss 7.8epss 0.00
Memory corruption in Audio while running invalid audio recording from ADSP.