Skip to content
BackEsc
Sign in

CWE-193 · weakness in Memory Corruption

Off-by-one Error

227 CVEs · 1 exploited

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
1
likely to be exploited
13

Every one of the 227 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line ar…CVE-2021-3156Sudo · CVSS 7.8 · 100% likely

    Sudo project

  2. Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 throu…CVE-2003-046678% likely
  3. GIMP PSP File Parsing Off-By-One Remote Code Execution VulnerabilityCVE-2023-44444GIMP · CVSS 7.8 · 56% likely

    GIMP

  4. A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting i…CVE-2021-23017Nginx Web Server, Nginx Plus · 53% likely
  5. Apache Tomcat: Fix for CVE-2023-24998 is incompleteCVE-2023-28709Apache Software Foundation · 48% likely

    Apache

  6. A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From t…CVE-2018-882830% likely
  7. Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional ch…CVE-2002-174519% likely
  8. Format string vulnerability in Infodrom cfingerd 1.4.3 and earlier allows a remote attacker to gain additional privileges via a malformed ident reply that is passed to the syslog…CVE-2001-060918% likely
  9. Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of service (stack corruption and applicat…CVE-2009-121716% likely
  10. Off-by-one error in the xlog function of mountd in the Linux NFS utils package (nfs-utils) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute a…CVE-2003-025216% likely
  11. Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges.CVE-2002-008315% likely
  12. Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allo…CVE-2007-205214% likely
  13. Multiple buffer overflows in Gaim 0.75 allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) octal encoding in yahoo_decode that causes a…CVE-2004-000511% likely
  14. Multiple off-by-one errors in the WW8DopTypography::ReadFromMem function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to cause a denial of ser…CVE-2010-345410% likely
  15. Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM, (2) GIO…CVE-2003-03569.6% likely
  16. Off-by-one buffer overflow in the sock_gets function in sockhelp.c for ATPhttpd 0.4b and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.CVE-2002-1816CVSS 9.8 · 9.0% likely
  17. Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of servi…CVE-2005-12688.4% likely
  18. cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ul…CVE-2019-199068.0% likely
  19. Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory c…CVE-2016-101607.4% likely
  20. Off-by-one error in certain versions of xfstt allows remote attackers to read potentially sensitive memory via a malformed client request in the connection handshake, which leaks…CVE-2003-06257.1% likely
  21. An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements.…CVE-2019-125215.9% likely
  22. Off-by-one buffer overflow in _xlate_ascii_write() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.CVE-2004-03465.7% likely
  23. Windows Kernel Denial of Service VulnerabilityCVE-2022-30155Microsoft · CVSS 5.5 · 5.3% likely

    Microsoft

  24. Off-by-one buffer overflow in Basic Authentication in Acme Labs thttpd 1.95 through 2.20 allows remote attackers to cause a denial of service and possibly execute arbitrary code.CVE-2001-14965.1% likely
  25. Off-by-one error in the MIME Multipart dissector in Wireshark (formerly Ethereal) 0.10.1 through 0.99.3 allows remote attackers to cause a denial of service (crash) via certain ve…CVE-2006-4574CVSS 7.5 · 4.4% likely
  26. An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to Do…CVE-2018-145994.2% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in