# Out-of-bounds memory read

A parser or native consumer reads outside the valid extent of an object or buffer, potentially causing a crash or disclosure depending on how the result is used.

**Candidate CWE:** [CWE-125](https://cwe.mitre.org/data/definitions/125.html)

## Test hypothesis

Build the real parser with AddressSanitizer, provide realistic byte input through its public API, and minimize a reproducible failure. Verify lengths and object ownership in the harness. Check a supported consumer separately; prove returned adjacent synthetic data if claiming disclosure.

## Evidence required

Minimal input and hash, revision, compiler flags, symbolized read/allocation trace, relevant sizes, and supported API invocation. A crashing read does not by itself prove information disclosure.

## Rule out false positives

Harness passes an incorrect size or invalid pointer contrary to the API contract; fault occurs only in test scaffolding; or an ordinary bounds-checked error is mistaken for a memory access.

## Playbook and command references

- [Libraries and parsers: bounded fuzzing to a minimal reproducer](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/parser-fuzzing.html) — Build a realistic local harness, instrument the target, bound fuzzing resources, and turn unique faults into defensible library or consumer reports.
- [Dependencies: from advisory match to reachable impact](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/dependency-reachability.html) — Separate composition, advisory matching, runtime reachability, and exploit prerequisites so dependency reports describe product impact.

[Find the associated command snippets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/commands.html?q=Libraries%20and%20parsers%3A%20bounded%20fuzzing%20to%20a%20minimal%20reproducer)

## Referenced by these target playbooks

[OSS & self-hosted](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/oss.html) · [Desktop & extensions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/desktop.html) · [Mobile](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/mobile.html) · [Network services](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/network.html) · [Hardware & firmware](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/hardware.html) · [AI, agents & MCP](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/ai.html)

## Report checklist

- [ ] Capture the affected version, configuration, identities, and object ownership.
- [ ] Preserve a valid baseline and a negative control.
- [ ] Reproduce the forbidden data access, action, or state change on controlled fixtures.
- [ ] Explain the intended security rule and why the observed behavior violates it.
- [ ] State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.

## Conditional ATT&CK mapping

No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the [mapping guide](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/attack.html).

## Primary references

- [MITRE CWE-125](https://cwe.mitre.org/data/definitions/125.html)
- [Clang AddressSanitizer](https://clang.llvm.org/docs/AddressSanitizer.html)

[Back to the complete vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html)