CWE-193 · Memory Corruption
Off-by-one Error
228CVEs
SortMost likely exploited
228 CVEs with CWE-193 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-3156In CISA KEVExploitedSudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line ar…Sudo · Sudo · CVSS 7.8 · 2021-01-26 | 7.8 | 100% | 2021-01-26 |
| CVE-2003-0466Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 throu…Wuftpd · Wu-Ftpd · 2003-08-01 | – | 78% | 2003-08-01 |
| CVE-2023-44444GIMP PSP File Parsing Off-By-One Remote Code Execution VulnerabilityGIMP · GIMP · CVSS 7.8 · 2024-05-03 | 7.8 | 56% | 2024-05-03 |
| CVE-2021-23017A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting i…F5 · Nginx Web Server, Nginx Plus · 2021-06-01 | – | 53% | 2021-06-01 |
| CVE-2023-28709Apache Tomcat: Fix for CVE-2023-24998 is incompleteApache Software Foundation · Apache Tomcat · 2023-05-22 | – | 48% | 2023-05-22 |
| CVE-2018-8828A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From t…Kamailio · Kamailio · 2018-03-20 | – | 30% | 2018-03-20 |
| CVE-2002-1745Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional ch…Microsoft · Internet Information Services · 2005-06-21 | – | 19% | 2005-06-21 |
| CVE-2001-0609Format string vulnerability in Infodrom cfingerd 1.4.3 and earlier allows a remote attacker to gain additional privileges via a malformed ident reply that is passed to the syslog…Infodrom · Cfingerd · 2001-07-27 | – | 18% | 2001-07-27 |
| CVE-2009-1217Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of service (stack corruption and applicat…Microsoft · Gdi+ · 2009-04-01 | – | 16% | 2009-04-01 |
| CVE-2003-0252Off-by-one error in the xlog function of mountd in the Linux NFS utils package (nfs-utils) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute a…Linux-Nfs · Nfs-Utils · 2003-07-15 | – | 16% | 2003-07-15 |
| CVE-2002-0083Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges.Openbsd · Openssh · 2002-06-25 | – | 15% | 2002-06-25 |
| CVE-2007-2052Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allo…Python · Python · 2007-04-16 | – | 14% | 2007-04-16 |
| CVE-2004-0005Multiple buffer overflows in Gaim 0.75 allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) octal encoding in yahoo_decode that causes a…Gaim Project · Gaim · 2004-02-03 | – | 11% | 2004-02-03 |
| CVE-2010-3454Multiple off-by-one errors in the WW8DopTypography::ReadFromMem function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to cause a denial of ser…Apache · Openoffice · 2011-01-28 | – | 10% | 2011-01-28 |
| CVE-2003-0356Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM, (2) GIO…Ethereal · Ethereal · 2003-05-30 | – | 9.6% | 2003-05-30 |
| CVE-2002-1816Off-by-one buffer overflow in the sock_gets function in sockhelp.c for ATPhttpd 0.4b and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.Redshift · Atphttpd · CVSS 9.8 · 2005-06-28 | 9.8 | 9.0% | 2005-06-28 |
| CVE-2005-1268Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of servi…Apache · Http Server · 2005-08-05 | – | 8.4% | 2005-08-05 |
| CVE-2019-19906cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ul…Cyrusimap · Cyrus-Sasl · 2019-12-19 | – | 8.0% | 2019-12-19 |
| CVE-2016-10160Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory c…Php · Php · 2017-01-24 | – | 7.4% | 2017-01-24 |
| CVE-2003-0625Off-by-one error in certain versions of xfstt allows remote attackers to read potentially sensitive memory via a malformed client request in the connection handshake, which leaks…Hadrons · Xfstt · 2003-08-01 | – | 7.1% | 2003-08-01 |
| CVE-2019-12521An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements.…Squid-Cache · Squid · 2020-04-15 | – | 5.9% | 2020-04-15 |
| CVE-2004-0346Off-by-one buffer overflow in _xlate_ascii_write() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.Proftpd · Proftpd · 2004-03-18 | – | 5.7% | 2004-03-18 |
| CVE-2022-30155Windows Kernel Denial of Service VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 5.5 · 2022-06-15 | 5.5 | 5.3% | 2022-06-15 |
| CVE-2001-1496Off-by-one buffer overflow in Basic Authentication in Acme Labs thttpd 1.95 through 2.20 allows remote attackers to cause a denial of service and possibly execute arbitrary code.Acme · Thttpd · 2005-06-21 | – | 5.1% | 2005-06-21 |
| CVE-2006-4574Off-by-one error in the MIME Multipart dissector in Wireshark (formerly Ethereal) 0.10.1 through 0.99.3 allows remote attackers to cause a denial of service (crash) via certain ve…Wireshark · Wireshark · CVSS 7.5 · 2006-10-28 | 7.5 | 4.4% | 2006-10-28 |
| CVE-2018-14599An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to Do…X.org · Libx11 · 2018-08-24 | – | 4.2% | 2018-08-24 |
| CVE-2022-34970Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful exploitation this vulnerability allows attackers to remotely execute…Crowcpp · Crow · 2022-08-04 | – | 4.0% | 2022-08-04 |
| CVE-2019-8272UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code execution. This attack appears to be exploitable via networ…Kaspersky Lab · UltraVNC · 2019-03-09 | – | 3.9% | 2019-03-09 |
| CVE-2019-8268UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of ClientConnection::ReadString function, which can potentially res…Kaspersky Lab · UltraVNC · 2019-03-09 | – | 3.9% | 2019-03-09 |
| CVE-2011-1027Off-by-one error in the convert_query_hexchar function in html.c in cgit.cgi in cgit before 0.8.3.5 allows remote attackers to cause a denial of service (infinite loop) via a stri…Lars Hjemli · Cgit · 2011-03-20 | – | 3.7% | 2011-03-20 |
| CVE-2018-14682An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression.Cabextract · Libmspack · 2018-07-28 | – | 3.7% | 2018-07-28 |
| CVE-2008-3964Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of service (crash) or have unspecified ot…Libpng · Libpng · 2008-09-10 | – | 3.3% | 2008-09-10 |
| CVE-2018-14679An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial o…Cabextract · Libmspack · 2018-07-28 | – | 3.3% | 2018-07-28 |
| CVE-2014-8182An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an attacker could crash…openldap · openldap · 2020-01-02 | – | 3.1% | 2020-01-02 |
| CVE-2020-10062Packet length decoding error in MQTTzephyrproject-rtos · zephyr · CVSS 9 · 2020-06-05 | 9.0 | 2.9% | 2020-06-05 |
| CVE-2021-46848GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.Gnu · Libtasn1 · CVSS 9.1 · 2022-10-24 | 9.1 | 2.8% | 2022-10-24 |
| CVE-2020-8443In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to an off-by-one heap-based buffer overflow during the cleaning…Ossec · Ossec · 2020-01-30 | – | 2.7% | 2020-01-30 |
| CVE-2018-5800An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.7 can be exploited to cause a heap-based buff…Libraw · LibRaw · 2018-12-07 | – | 2.5% | 2018-12-07 |
| CVE-2020-14510OFF-BY-ONE ERROR CWE-193Secomea · GateManager · CVSS 9.8 · 2020-08-25 | 9.8 | 2.5% | 2020-08-25 |
| CVE-1999-1568Off-by-one error in NcFTPd FTP server before 2.4.1 allows a remote attacker to cause a denial of service (crash) via a long PORT command.Ncftp · Ncftpd Server · CVSS 7.5 · 2004-09-01 | 7.5 | 2.3% | 2004-09-01 |
| CVE-2002-1721Off-by-one error in alterMIME 0.1.10 and 0.1.11 allows remote attackers to cause a denial of service (crash) via an x-header that causes snprintf overwrite the FFGET_FILE variable…Pldaniels · Altermime · 2005-06-21 | – | 2.3% | 2005-06-21 |
| CVE-2015-0841Off-by-one error in the readBuf function in listener.cpp in libcapsinetwork and monopd before 0.9.8, allows remote attackers to cause a denial of service (crash) via a long line.monopd · monopd · 2019-12-09 | – | 2.2% | 2019-12-09 |
| CVE-2024-36136An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS.Ivanti · Avalanche · CVSS 7.5 · 2024-08-14 | 7.5 | 2.2% | 2024-08-14 |
| CVE-2021-31875In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse, which can potentially lead t…Cesanta · Mongooseos Mjs · 2021-04-29 | – | 2.2% | 2021-04-29 |
| CVE-2010-1773Off-by-one error in the toAlphabetic function in rendering/RenderListMarker.cpp in WebCore in WebKit before r59950, as used in Google Chrome before 5.0.375.70, allows remote attac…Google · Chrome · 2010-09-24 | – | 2.1% | 2010-09-24 |
| CVE-2018-7329In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-s7comm.c had an infinite loop that was addressed by correcting off-by-one errors.Wireshark · Wireshark · 2018-02-23 | – | 2.1% | 2018-02-23 |
| CVE-2019-13306ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.Imagemagick · Imagemagick · 2019-07-05 | – | 2.1% | 2019-07-05 |
| CVE-2019-13305ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.Imagemagick · Imagemagick · 2019-07-05 | – | 2.1% | 2019-07-05 |
| CVE-2019-18423An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_to_physmap hypercall. p2m->max_mapped_gfn is used by the fu…Xen · Xen · 2019-10-31 | – | 2.1% | 2019-10-31 |
| CVE-2019-14532An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table.Sleuthkit · The Sleuth Kit · 2019-08-02 | – | 2.0% | 2019-08-02 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.