Out-of-bounds read

In computer security and programming, an out-of-bounds read is a software anomaly where a program, while reading data from a buffer, reads outside of the buffer's boundary from adjacent memory. This is a special case of violation of memory safety and is a form of data confidentiality violation (see CIA triad). A buffer over-read and buffer under-read are special cases of out-of-bounds reads.

Out-of-bounds reads are the basis of many software vulnerabilities. In some cases, they can be maliciously exploited to access privileged information. For example, they can sometimes be triggered, as in the Heartbleed bug, by maliciously crafted inputs that are designed to exploit a lack of bounds checking to read inaccessible parts of memory.

At other times, out-of-bounds reads can result in other erratic program behavior, including memory access errors (including invalid page faults), incorrect results, or crashes. For example, the widespread IT outages in 2024 were caused by an out-of-bounds memory error in cybersecurity software developed by CrowdStrike.

Programming languages commonly associated with out-of-bounds reads include C and C++, which provide no built-in protection against using pointers to access data in any part of virtual memory, and which do not automatically check that reading data from a block of memory is safe; respective examples are attempting to read more elements than contained in an array, or failing to append a trailing terminator to a null-terminated string.

Bounds checking, sandboxing, static analysis, using memory safe programming languages, and program verification can prevent buffer over-reads, while techniques such as fuzz testing can help detect them.