Skip to content

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Overview

This is the general buffer-bounds weakness: a read, write, or pointer/index operation on a buffer, array, or memory region proceeds without confirming that the computed index, offset, or length stays within the region's actual allocated bounds. It covers both directions of the failure - reading past the end and writing past the end - plus operations that could do either, such as a generic copy call driven by an untrusted or miscalculated size. It is almost exclusive to languages with manual memory management and unchecked indexing, such as C and C++; languages that bounds-check ordinary array or buffer access do not have this failure mode through normal indexing.

Relationship to Other CWEs

CWE-119 is a MITRE Class and MITRE marks it Discouraged for mapping findings, recommending a more specific descendant instead.

Use this page when the operation is mixed or unclear, or when a finding names CWE-119 directly and none of the more specific pages fit.

Risk

Critical: An operation that reads or writes outside a buffer's allocated bounds can corrupt adjacent memory, expose data the caller was never meant to see, crash the process, or allow arbitrary code execution. Which of those outcomes is reachable depends on whether the access is a read or a write.

Remediation Steps

Core Principle: Never trust an index, offset, or length to be in range - validate it against the buffer's actual allocated size before every access, and prefer types and APIs that enforce this automatically over manual bounds checking.

Trace the Data Path

  • Source: Any index, offset, or length value influenced by user input, file data, network data, or a calculation derived from them
  • Sink: The raw buffer access itself - an array index, pointer arithmetic, or a copy/format function writing into or reading from a fixed-size region
  • Missing Controls: No check that the index or offset + length stays within [0, size) of the buffer's real, currently allocated capacity, or a size/length calculation that can be wrong (integer overflow, stale cached size, off-by-one) before the access happens

Classify the Operation First

Determine whether the access at each site is a read, a write, or both. Whenever that distinction is clear, follow the matching page (CWE-125 for reads, CWE-787 for writes): the remediation differs enough between the two that treating them separately produces a more precise fix.

Use Bounds-Checked Abstractions (Primary Defense)

  • Prefer containers and view types that track their own capacity and refuse an out-of-range access - such as a checked span/slice type or a bounds-checked accessor - over raw pointer arithmetic or hand-indexed arrays
  • Where a language or library offers both a checked and an unchecked way to access a buffer, default to the checked one and only drop to the unchecked form with an explicit, verified bounds check immediately before it
  • Perform any arithmetic used to compute an index, offset, or length with overflow-safe operations; an integer overflow in the size calculation can defeat an otherwise-correct bounds check

Validate Every Access Against the Buffer's Real Capacity (Defense in Depth)

  • Track the true allocated size of every buffer alongside the buffer itself, and keep it in sync across reallocations, truncations, or reslicing
  • Recompute or re-check the size at the point of access rather than trusting a value cached earlier
  • Enable sanitizer and bounds-checking builds (AddressSanitizer, -fsanitize=bounds, stack protection) in CI, and fuzz any function that touches a buffer with an attacker-influenced offset or length

Test with Boundary and Malicious Inputs

  • The last valid index and the first invalid index one past it
  • Negative indices, where the type permits them
  • Oversized lengths and offsets, including values crafted to overflow the bounds-check arithmetic itself
  • Re-scan with the security scanner and run sanitizer/fuzzing builds to confirm the finding is resolved

Additional Resources