CWE-466 describes a function that can return a pointer to memory outside the buffer the pointer is expected to reference. Callers trust the pointer and use it.
MITRE lists memory-unsafe languages, specifically C and C++, as the affected platforms.
How it happens
A function searches or walks a buffer and computes a pointer into it. A miscalculation, an off-by-one, or a missing bounds check lets the returned pointer land before the start or after the end. The caller dereferences it without any way to know.
The record has no demonstrative example and no observed CVEs, so this post sticks to what MITRE states.
What an attacker gains
MITRE lists confidentiality and integrity impact: reading memory and modifying memory. A pointer outside the buffer can expose adjacent data or allow writes to it.
How to find it
MITRE lists two methods:
- Automated static analysis (SAST), which can find some instances by modeling data flow and control flow, then searching for vulnerable patterns.
- Automated dynamic analysis with compiler-integrated runtime checks for memory safety errors, such as AddressSanitizer (ASan) for C and C++. Crafted inputs are needed to reach the code with the error, for example generated by fuzzing.
How to fix it
The record lists no formal mitigations. Reasonable steps for any function that returns pointers:
- Document and enforce the valid range of the returned pointer.
- Return an index or a length together with the base pointer, and have callers check it.
- Return NULL or an error when no valid location exists.
- Run tests under ASan.
Quick check
How do you reach this bug in testing?
Per MITRE, crafted inputs are needed to reach the code, so fuzzing under ASan is a good way to trigger and catch it.
