Weaknesses of type CWE-130

144 results

Inconsistência no tratamento de parâmetros de comprimento

Ocorre quando o código não valida ou trata adequadamente inconsistências entre o comprimento declarado de um buffer/string e seu tamanho real. Um atacante explora essa discrepância para causar leitura ou escrita fora dos limites, levando a vazamento de dados, corrupção de memória ou execução de código.

Example

Uma função recebe uma string com um parâmetro 'length' que não corresponde ao tamanho real do buffer. Se o código copia 'length' bytes sem verificar se o buffer realmente possui esse tamanho, um memcpy() ou strcpy() escreve além do limite alocado, ou lê dados inválidos de memória adjacente.

How to mitigate

Sempre validar que o parâmetro de comprimento é coerente com o tamanho real do buffer antes de operações de cópia ou leitura. Use funções seguras (strncpy, memcpy_s) e implemente checks explícitos: se length > buffer_size, rejeitar ou truncar. Ferramentas de análise estática ajudam a detectar esse padrão.

CVE-2026-101994HIGHJunos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes l2ald heap disclosure or crashEPSS 0.3%CVE-2026-94633HIGHApache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name lengthEPSS 0.3%CVE-2026-114646MEDIUMNoSQL command injection via mismatched raw BSON length prefix written verbatim to the wireEPSS 0.3%CVE-2026-71402MEDIUMwicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total lengthEPSS 0.2%CVE-2026-102054MEDIUMJunos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configuredEPSS 0.2%CVE-2021-26329—AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss EPSS 0.2%CVE-2026-47692MEDIUMEnvoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application streamEPSS 0.2%CVE-2025-10458HIGHBluetooth: le_conn_rsp does not sanitize CID, MTU, MPS valuesEPSS 0.2%CVE-2026-15418LOWCP210x Memory LeakageEPSS 0.2%CVE-2026-62423MEDIUMbuffer overruns in libfsimage iso9660 handlingEPSS 0.2%CVE-2026-62424MEDIUMbuffer overruns in libfsimage iso9660 handlingEPSS 0.2%CVE-2024-47293MEDIUMOut-of-bounds write vulnerability in the HAL-WIFI module Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.2%CVE-2026-45615HIGHmouse07410/asn1c: 1-byte Heap Out-of-Bounds Read in `INTEGER_decode_oer` via Malformed OER PayloadEPSS 0.2%CVE-2025-48022MEDIUMA vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciouEPSS 0.2%CVE-2026-101991MEDIUMJunos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engineering routing is enabledEPSS 0.2%CVE-2026-115794LOWAlarm data length not validated against received frame lengthEPSS 0.2%CVE-2026-58097HIGHppp(8): missing length validation in mp_SetEnddisc()EPSS 0.2%CVE-2026-34831MEDIUMRack: Content-Length mismatch in Rack::Files error responsesEPSS 0.2%CVE-2026-25572MEDIUMA vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The SICAM SIAPP SDK server component does not enforce maximuEPSS 0.1%CVE-2023-52547HIGHHuawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26. Memory Corruption in SMI Handler of HddPassword SMM Module. This can be leveraged by a maEPSS 0.1%