Weaknesses of type CWE-131

190 results

Cálculo incorreto do tamanho de buffer

O desenvolvedor calcula errado quantos bytes um buffer precisa armazenar, geralmente por erro de lógica matemática, confundindo unidades (bytes vs. elementos) ou não contando caracteres especiais como nulo terminador. Isso abre espaço para estouro de buffer quando dados maiores que o esperado são copiados para esse espaço insuficiente.

Example

Um programa aloca espaço para uma string com `malloc(strlen(entrada))` esquecendo o byte do nulo terminador; quando copia a string com `strcpy()`, escreve além dos limites alocados. Ou calcula `tamanho = num_elementos * 4` quando deveria ser `num_elementos * sizeof(tipo)`.

How to mitigate

Use funções seguras como `snprintf()` ou `strncpy()` que respeitam limites; valide o tamanho final antes de alocar memória; prefira bibliotecas de string seguras; implemente testes unitários que cubram casos-limite (strings vazias, máximo esperado, acima do máximo).

CVE-2026-1949CRITICALIncorrect calculation of buffer size on the stack in AS320TEPSS 0.6%CVE-2026-2050HIGHGIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-75093MEDIUMsonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer sizeEPSS 0.6%CVE-2025-43965LOWIn MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.EPSS 0.6%CVE-2024-5000HIGHCODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA productsEPSS 0.6%CVE-2026-27820LOWzlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruptionEPSS 0.6%CVE-2023-52557HIGHOpenBSD 7.3 invalid l2tp message npppd crashEPSS 0.6%CVE-2026-116570HIGHFreeSWITCH: Pre-authentication stack buffer overflow in mod_xml_rpc HTTP directory authenticationEPSS 0.6%CVE-2025-66216CRITICALAIS-catcher has a Buffer Overflow vulnerability in `AIS::Message` leading to DoS/RCEEPSS 0.5%CVE-2026-29645HIGHNEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decodeEPSS 0.5%CVE-2026-92156MEDIUMF´: EventManager asserts on legal oversized LogBuffer values delivered over the standard GenericHub event bridgeEPSS 0.5%CVE-2026-22590CRITICALFast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG  sampleSize / fragmentsInSubmessageEPSS 0.5%CVE-2026-55827HIGHFreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decodeEPSS 0.5%CVE-2024-23805HIGHF5 Application Visibility and Reporting module and BIG-IP Advanced WAF/ASM vulnerabilityEPSS 0.5%CVE-2024-45287CRITICALMultiple vulnerabilities in libnvEPSS 0.5%CVE-2026-31478CRITICALksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()EPSS 0.5%CVE-2026-44254MEDIUMWazuh: Stack Out-of-Bounds Write in remoted Decompression PathEPSS 0.5%CVE-2022-41907MEDIUMOverflow in `ResizeNearestNeighborGrad` in TensorflowEPSS 0.5%CVE-2022-41887MEDIUMOverflow in `tf.keras.losses.poisson` in TensorflowEPSS 0.5%CVE-2026-1188MEDIUMIn the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor featurEPSS 0.5%