What Is An Out-of-Bounds Read and Out-of-Bounds Write Error?

CWE-125 Out-of-Bounds Read is a type of software error that can occur when reading data from memory. This can happen if the program tries to read beyond the end of an array, for example. Out of bounds reads can lead to crashes or other unexpected vulnerabilities, and may allow an attacker to read sensitive information that they should not have access to. 

To avoid out-of-bounds reads, programs should check that the index they are using to read data is within the bounds of the array. If it is not, the program should take some other action, such as returning an error or printing a warning message.

If you are writing a program that might read data from memory, it is important to be aware of this type of error and take steps to avoid it. Otherwise, your program may crash or behave unexpectedly.

CWE-787 Out-of-Bounds Write is another type of software vulnerability in which a program writes outside the bounds of an allocated area of memory, potentially leading to a crash or arbitrary code execution. This can occur when the size of the data written is larger than the size of the allocated memory area, when the data is written to an incorrect location within the memory area, or when the program incorrectly calculates the size or location of the data to be written.

Out-of-Bounds Write vulnerabilities can be exploited by an attacker to crash a program or execute arbitrary code. In some cases, these vulnerabilities can beOut exploited to overwrite critical program data structures, such as the heap control blocks, which can lead to a denial-of-service attack. Other times, an attacker can use an out-of-bounds write to modify program execution flow, such as by overwriting a function pointer or return address on the stack, which can lead to arbitrary code execution.

To prevent out-of-bounds write vulnerabilities, programmers should carefully validate all inputs to ensure that they fall within the expected range. Additionally, programs should use memory safety features such as canaries or ASLR to make it more difficult for an attacker to exploit these vulnerabilities.

Development Speed or Code Security. Why Not Both?

Mayhem is an award-winning AI that autonomously finds new exploitable bugs and improves your test suites.

Get Mayhem Free Request A Demo