# Buffer overread information disclosure

Reads past initialized bytes: unterminated strings, delimiter mismatches, unchecked pointer advances, fill-without-terminate

_Area: Memory corruption and native code. Seen in 7 disclosed reports; one confirmed bounty: $1,000; latest 2026-06-30. Updated 2026-10-23._

## How it works
A read continues past the bytes that are actually initialized because the code trusts a bound the input does not honor. Three shapes recur. **Terminator-mismatch**: a string API (or a parser's own scan) assumes a NUL or delimiter the input never supplies, so it walks past the buffer [E1](https://bugbountylibrary.com/r/blog%3Athalium-github-io-blog-posts-leaking-aslr-through-rdp-printer-cache-registry.md)[E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451.md)[E4](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-squidbleed-cve-2026-47729.md). **Offset-overrun**: a parser tokenizes with one delimiter set but reconstructs a substring offset assuming another, pushing a pointer past the NUL [E3](https://bugbountylibrary.com/r/h1%3A824163.md). **Read-overrun**: a decoder advances a pointer without checking it against the end pointer [E6](https://bugbountylibrary.com/r/h1%3A1209681.md). A related write-side gap: a conversion backend fills a buffer exactly without terminating, and the later read runs past it [E7](https://bugbountylibrary.com/r/h1%3A2621062.md). In each case adjacent memory is copied into a response, a registry key, or a cookie. The invariant: no read or transmit length may exceed the bytes known to be initialized in the buffer.

## Where it shows up
- Peer-controlled strings passed to OS APIs requiring NUL termination (e.g. `RegCreateKeyExW`) with no length check [E1](https://bugbountylibrary.com/r/blog%3Athalium-github-io-blog-posts-leaking-aslr-through-rdp-printer-cache-registry.md).
- Custom XML/attribute parsers where quoted and unquoted paths terminate differently; a newline ends one but not the other [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451.md).
- Whitespace-skip loops using `strchr(set, *p)`, which matches the terminating NUL and walks off the end on empty trailing fields [E4](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-squidbleed-cve-2026-47729.md).
- Parser tokenization using one delimiter set but reconstructing offsets assuming another [E3](https://bugbountylibrary.com/r/h1%3A824163.md).
- UTF-8/IDNA decoders that advance `p` without validating `p+N` against the end pointer [E6](https://bugbountylibrary.com/r/h1%3A1209681.md).
- Conversion backends that fill a buffer exactly without terminating, on exact-size input [E7](https://bugbountylibrary.com/r/h1%3A2621062.md).

## How to review
Name the exact bound per sink. For a string handed to an OS/string API, the bound is termination: verify the input is NUL-terminated or an explicit length is passed [E1](https://bugbountylibrary.com/r/blog%3Athalium-github-io-blog-posts-leaking-aslr-through-rdp-printer-cache-registry.md). For a parser scan, the bound is the buffer end: confirm every pointer advance is checked against the end pointer, and compare termination rules across quoted and unquoted paths [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451.md)[E4](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-squidbleed-cve-2026-47729.md). For offset reconstruction, confirm the delimiter set used to tokenize matches the one assumed when computing offsets [E3](https://bugbountylibrary.com/r/h1%3A824163.md). For a decoder, each multi-byte read must validate `p+N <= pe` before dereferencing [E6](https://bugbountylibrary.com/r/h1%3A1209681.md). For a conversion backend, test exact-buffer-length inputs and confirm termination before the result is read [E7](https://bugbountylibrary.com/r/h1%3A2621062.md). False positive: a bounded copy that clamps to the initialized length is safe even if the source is unterminated; a scan that stops at a checked end pointer is safe even without a NUL.

## Variants seen
- Missing NUL termination leaking heap pointers into persistent registry state [E1](https://bugbountylibrary.com/r/blog%3Athalium-github-io-blog-posts-leaking-aslr-through-rdp-printer-cache-registry.md).
- Parser terminator mismatch leaking memory via a cookie [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451.md).
- Delimiter/offset mismatch in a pooled-buffer parser leaking other users' data [E3](https://bugbountylibrary.com/r/h1%3A824163.md).
- NUL-as-whitespace loop overreading heap in a listing parser [E4](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-squidbleed-cve-2026-47729.md).
- Pointer advance without end check in a UTF-8 decoder [E6](https://bugbountylibrary.com/r/h1%3A1209681.md).
- Fill-without-terminate then read in punycode conversion on a 256-byte name [E7](https://bugbountylibrary.com/r/h1%3A2621062.md).

## Why fixes fail
Bounding one parser path (quoted values) leaves the other (unquoted) open [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451.md); fixing one delimiter assumption without auditing the tokenizer leaves the offset path exposed [E3](https://bugbountylibrary.com/r/h1%3A824163.md); a length check that exists but runs after the read is masked until an alternate allocation path removes the slack [E4](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-squidbleed-cve-2026-47729.md).

## Impact and severity
Leaked session tokens enabled pre-auth hijacking [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451.md); pointer leaks broke ASLR/KASLR [E1](https://bugbountylibrary.com/r/blog%3Athalium-github-io-blog-posts-leaking-aslr-through-rdp-printer-cache-registry.md). Severity rises when the leak is unauthenticated, repeatable, and reaches secrets or pointers.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Athalium-github-io-blog-posts-leaking-aslr-through-rdp-printer-cache-registry.md
- E2: https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451.md
- E3: https://bugbountylibrary.com/r/h1%3A824163.md
- E4: https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-squidbleed-cve-2026-47729.md
- E5: https://bugbountylibrary.com/r/blog%3Agithub-com-puliczek-cve-2021-21123-poc-google-chrome.md
- E6: https://bugbountylibrary.com/r/h1%3A1209681.md
- E7: https://bugbountylibrary.com/r/h1%3A2621062.md
- E8: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-everything-we-know-about-cve-2023-23397.md