Weaknesses of type CWE-131

163 results

Cálculo incorreto do tamanho de buffer

O desenvolvedor calcula errado quantos bytes um buffer precisa armazenar, geralmente por erro de lógica matemática, confundindo unidades (bytes vs. elementos) ou não contando caracteres especiais como nulo terminador. Isso abre espaço para estouro de buffer quando dados maiores que o esperado são copiados para esse espaço insuficiente.

Example

Um programa aloca espaço para uma string com `malloc(strlen(entrada))` esquecendo o byte do nulo terminador; quando copia a string com `strcpy()`, escreve além dos limites alocados. Ou calcula `tamanho = num_elementos * 4` quando deveria ser `num_elementos * sizeof(tipo)`.

How to mitigate

Use funções seguras como `snprintf()` ou `strncpy()` que respeitam limites; valide o tamanho final antes de alocar memória; prefira bibliotecas de string seguras; implemente testes unitários que cubram casos-limite (strings vazias, máximo esperado, acima do máximo).

CVE-2025-46393LOWIn multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels iEPSS 0.4%CVE-2026-33984HIGHFreeRDP: ClearCodec resize_vbar_entry() Heap OOB WriteEPSS 0.4%CVE-2026-41197CRITICALBrillig: Heap corruption in foreign call results with nested tuple arraysEPSS 0.4%CVE-2026-49841CRITICALFreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body readEPSS 0.4%CVE-2026-42915MEDIUMMicrosoft Windows VMSwitch Denial of Service VulnerabilityEPSS 0.4%CVE-2026-22590CRITICALFast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG  sampleSize / fragmentsInSubmessageEPSS 0.4%CVE-2026-54696LOWRuby JSON: JSON generator heap buffer overflow when streaming to an IOEPSS 0.4%CVE-2026-44254MEDIUMWazuh: Stack Out-of-Bounds Write in remoted Decompression PathEPSS 0.4%CVE-2026-52955CRITICALlibceph: Fix potential out-of-bounds access in crush_decode()EPSS 0.4%CVE-2026-70457HIGHrsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()EPSS 0.4%CVE-2026-29004HIGHBusyBox DHCPv6 Client Heap Buffer Overflow via DNS_SERVERSEPSS 0.4%CVE-2026-44223MEDIUMvLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parametersEPSS 0.4%CVE-2026-26200HIGHHDF5 Affected by H5T__conv_struct_opt Heap Buffer OverflowEPSS 0.4%CVE-2025-0395MEDIUMWhen the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure mesEPSS 0.4%CVE-2022-25731HIGHIncorrect Calculation of Buffer Size in MODEMEPSS 0.4%CVE-2025-55297MEDIUMESF-IDF BluFi Example Memory Overflow VulnerabilityEPSS 0.3%CVE-2026-75093MEDIUMsonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer sizeEPSS 0.3%CVE-2026-55827HIGHFreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decodeEPSS 0.3%CVE-2026-11604MEDIUMAn incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authentiEPSS 0.3%CVE-2026-0280LOWPAN-OS: IPv6 Firewall Policy BypassEPSS 0.3%