Weaknesses of type CWE-130

118 results

Inconsistência no tratamento de parâmetros de comprimento

Ocorre quando o código não valida ou trata adequadamente inconsistências entre o comprimento declarado de um buffer/string e seu tamanho real. Um atacante explora essa discrepância para causar leitura ou escrita fora dos limites, levando a vazamento de dados, corrupção de memória ou execução de código.

Example

Uma função recebe uma string com um parâmetro 'length' que não corresponde ao tamanho real do buffer. Se o código copia 'length' bytes sem verificar se o buffer realmente possui esse tamanho, um memcpy() ou strcpy() escreve além do limite alocado, ou lê dados inválidos de memória adjacente.

How to mitigate

Sempre validar que o parâmetro de comprimento é coerente com o tamanho real do buffer antes de operações de cópia ou leitura. Use funções seguras (strncpy, memcpy_s) e implemente checks explícitos: se length > buffer_size, rejeitar ou truncar. Ferramentas de análise estática ajudam a detectar esse padrão.

CVE-2026-4371HIGHOut of bounds read in IMAP parsingEPSS 0.4%CVE-2026-22046HIGHiccDEV has heap-buffer-overflow in CIccProfileXml::ParseBasic() at IccXML/IccLibXML/IccProfileXml.cppEPSS 0.3%CVE-2026-67292CRITICALFreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosureEPSS 0.3%CVE-2026-60060MEDIUMImproper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm ProjecEPSS 0.3%CVE-2026-35547HIGHHeap overflow in libnvEPSS 0.3%CVE-2026-71337HIGHWindows Storage Management Provider Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-40199MEDIUMNet::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypassEPSS 0.3%CVE-2025-23247MEDIUMNVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a failure to check the length of a buffer coulEPSS 0.3%CVE-2024-35313HIGHIn Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.EPSS 0.3%CVE-2026-33555MEDIUMAn issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announcEPSS 0.3%CVE-2026-48685MEDIUMFastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly parses BGP path attributes with the extendEPSS 0.3%CVE-2026-9054CRITICALInvalid IP packets cause a kernel panicEPSS 0.3%CVE-2023-5778CRITICALMissing Length CheckEPSS 0.3%CVE-2026-45681MEDIUMOpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB sizeEPSS 0.3%CVE-2026-41898HIGHrust-openssl: Unchecked callback-returned length in PSK and cookie generate trampolines can cause OpenSSL to leak adjacent memory to the network peerEPSS 0.3%CVE-2025-52949HIGHJunos OS and Junos OS Evolved: In an EVPN environment, receipt of specifically malformed BGP update causes RPD crashEPSS 0.3%CVE-2026-5706HIGHBuffer overflow in Bluetooth Mesh SDK when handling extended advertisementsEPSS 0.3%CVE-2026-48487MEDIUMZeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packetEPSS 0.2%CVE-2026-54466CRITICALwebsocket-driver: Message corruption via abuse of protocol length headersEPSS 0.2%CVE-2021-26329—AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss EPSS 0.2%