Weaknesses of type CWE-131

162 results

Cálculo incorreto do tamanho de buffer

O desenvolvedor calcula errado quantos bytes um buffer precisa armazenar, geralmente por erro de lógica matemática, confundindo unidades (bytes vs. elementos) ou não contando caracteres especiais como nulo terminador. Isso abre espaço para estouro de buffer quando dados maiores que o esperado são copiados para esse espaço insuficiente.

Example

Um programa aloca espaço para uma string com `malloc(strlen(entrada))` esquecendo o byte do nulo terminador; quando copia a string com `strcpy()`, escreve além dos limites alocados. Ou calcula `tamanho = num_elementos * 4` quando deveria ser `num_elementos * sizeof(tipo)`.

How to mitigate

Use funções seguras como `snprintf()` ou `strncpy()` que respeitam limites; valide o tamanho final antes de alocar memória; prefira bibliotecas de string seguras; implemente testes unitários que cubram casos-limite (strings vazias, máximo esperado, acima do máximo).

CVE-2025-62550HIGHAzure Monitor Agent Remote Code Execution VulnerabilityEPSS 0.7%CVE-2024-28052MEDIUMThe WBR-6012 is a wireless SOHO router. It is a low-cost device which functions as an internet gateway for homes and small offices while aimEPSS 0.7%CVE-2023-52558HIGHOpenBSD 7.4 and 7.3 m_split() network buffer kernel crashEPSS 0.7%CVE-2026-4695HIGHIncorrect boundary conditions in the Audio/Video: Web Codecs componentEPSS 0.7%CVE-2021-21773HIGHAn out-of-bounds write vulnerability exists in the TIFF header count-processing functionality of Accusoft ImageGear 19.8. A specially crafteEPSS 0.7%CVE-2026-31806CRITICALFreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap DimensionsEPSS 0.7%CVE-2026-78002HIGHRsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() functionEPSS 0.7%CVE-2026-39892MEDIUMcryptography has a buffer overflow if non-contiguous buffers were passed to APIsEPSS 0.7%CVE-2026-34986HIGHGo JOSE affect by a panic in JWE decryptionEPSS 0.7%CVE-2026-43501CRITICALipv6: rpl: reserve mac_len headroom when recompressed SRH growsEPSS 0.7%CVE-2021-3491HIGHLinux kernel io_uring PROVIDE_BUFFERS MAX_RW_COUNT bypassEPSS 0.6%CVE-2026-2047HIGHGIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.6%CVE-2024-30405HIGHJunos OS: SRX 5000 Series with SPC2: Processing of specific crafted packets when ALG is enabled causes a transit traffic Denial of ServiceEPSS 0.6%CVE-2026-20911CRITICALA heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A speEPSS 0.6%CVE-2024-11425HIGHCWE-131: Incorrect Calculation of Buffer Size vulnerability exists that could cause Denial-of-Service of the product when an unauthenticatedEPSS 0.6%CVE-2026-2049HIGHGIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-2050HIGHGIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-1949CRITICALIncorrect calculation of buffer size on the stack in AS320TEPSS 0.6%CVE-2025-43965LOWIn MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.EPSS 0.6%CVE-2024-5000HIGHCODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA productsEPSS 0.6%