The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.

While a pointer can contain a reference to any arbitrary memory location, a program typically only intends to use the pointer to access limited portions of memory, such as contiguous memory used to access an individual array.
Programs may use offsets in order to access fields or sub-elements stored within structured data. The offset might be out-of-range if it comes from an untrusted source, is the result of an incorrect calculation, or occurs because of another error.
If an attacker can control or influence the offset so that it points outside of the intended boundaries of the structure, then the attacker may be able to read or write to memory locations that are used elsewhere in the product. As a result, the attack might change the state of the product as accessed through program variables, cause a crash or instable behavior, and possibly lead to code execution.

Primary

Resultant

Untrusted pointer offset
This term is narrower than the concept of "out-of-range" offset, since the offset might be the result of a calculation or other error that does not depend on any externally-supplied values.

Implementation

Confidentiality
Read Memory
If the untrusted pointer is used in a read operation, an attacker might be able to read sensitive portions of memory.

Availability
DoS: Crash, Exit, or Restart
If the untrusted pointer references a memory location that is not accessible to the program, or points to a location that is "malformed" or larger than expected by a read or write operation, the application may terminate unexpectedly.

Integrity
Confidentiality
Availability
Execute Unauthorized Code or Commands
Modify Memory
If the untrusted pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

Automated Dynamic Analysis
Use tools that are integrated during
compilation to insert runtime error-checking mechanisms
related to memory safety errors, such as AddressSanitizer
(ASan) for C/C++ [REF-1518].
Moderate
Crafted inputs are necessary to
reach the code containing the error, such as generated
by fuzzers. Also, these tools may reduce performance,
and they only report the error condition - not the
original mistake that led to the
error.

CVE-2010-2160
Invalid offset in undocumented opcode leads to memory corruption.
https://www.cve.org/CVERecord?id=CVE-2010-2160

CVE-2010-1281
Multimedia player uses untrusted value from a file when using file-pointer calculations.
https://www.cve.org/CVERecord?id=CVE-2010-1281

CVE-2009-3129
Spreadsheet program processes a record with an invalid size field, which is later used as an offset.
https://www.cve.org/CVERecord?id=CVE-2009-3129

CVE-2009-2694
Instant messaging library does not validate an offset value specified in a packet.
https://www.cve.org/CVERecord?id=CVE-2009-2694

CVE-2009-2687
Language interpreter does not properly handle invalid offsets in JPEG image, leading to out-of-bounds memory access and crash.
https://www.cve.org/CVERecord?id=CVE-2009-2687

CVE-2009-0690
negative offset leads to out-of-bounds read
https://www.cve.org/CVERecord?id=CVE-2009-0690

CVE-2008-4114
untrusted offset in kernel
https://www.cve.org/CVERecord?id=CVE-2008-4114

CVE-2010-2873
"blind trust" of an offset value while writing heap memory allows corruption of function pointer,leading to code execution
https://www.cve.org/CVERecord?id=CVE-2010-2873

CVE-2010-2866
negative value (signed) causes pointer miscalculation
https://www.cve.org/CVERecord?id=CVE-2010-2866

CVE-2010-2872
signed values cause incorrect pointer calculation
https://www.cve.org/CVERecord?id=CVE-2010-2872

CVE-2007-5657
values used as pointer offsets
https://www.cve.org/CVERecord?id=CVE-2007-5657

CVE-2010-2867
a return value from a function is sign-extended if the value is signed, then used as an offset for pointer arithmetic
https://www.cve.org/CVERecord?id=CVE-2010-2867

CVE-2009-1097
portions of a GIF image used as offsets, causing corruption of an object pointer.
https://www.cve.org/CVERecord?id=CVE-2009-1097

CVE-2008-1807
invalid numeric field leads to a free of arbitrary memory locations, then code execution.
https://www.cve.org/CVERecord?id=CVE-2008-1807

CVE-2007-2500
large number of elements leads to a free of an arbitrary address
https://www.cve.org/CVERecord?id=CVE-2007-2500

CVE-2008-1686
array index issue (CWE-129) with negative offset, used to dereference a function pointer
https://www.cve.org/CVERecord?id=CVE-2008-1686

CVE-2010-2878
"buffer seek" value - basically an offset?
https://www.cve.org/CVERecord?id=CVE-2010-2878

Memory Management

Memory

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

There are close relationships between incorrect pointer dereferences and other weaknesses related to buffer operations. There may not be sufficient community agreement regarding these relationships. Further study is needed to determine when these relationships are chains, composites, perspective/layering, or other types of relationships. As of September 2010, most of the relationships are being captured as chains.
Many weaknesses related to pointer dereferences fall under the general term of "memory corruption" or "memory safety." As of September 2010, there is no commonly-used terminology that covers the lower-level variants.

CWE Content Team
MITRE
2010-09-22
1.10
2010-09-27

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated References

CWE Content Team
MITRE
2019-06-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2020-12-10
updated Relationships

CWE Content Team
MITRE
2022-04-28
updated Research_Gaps

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Detection_Factors, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Affected_Resources, Functional_Areas

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Detection_Factors, References, Time_of_Introduction, Weakness_Ordinalities