Weaknesses of type CWE-131

190 results

Cálculo incorreto do tamanho de buffer

O desenvolvedor calcula errado quantos bytes um buffer precisa armazenar, geralmente por erro de lógica matemática, confundindo unidades (bytes vs. elementos) ou não contando caracteres especiais como nulo terminador. Isso abre espaço para estouro de buffer quando dados maiores que o esperado são copiados para esse espaço insuficiente.

Example

Um programa aloca espaço para uma string com `malloc(strlen(entrada))` esquecendo o byte do nulo terminador; quando copia a string com `strcpy()`, escreve além dos limites alocados. Ou calcula `tamanho = num_elementos * 4` quando deveria ser `num_elementos * sizeof(tipo)`.

How to mitigate

Use funções seguras como `snprintf()` ou `strncpy()` que respeitam limites; valide o tamanho final antes de alocar memória; prefira bibliotecas de string seguras; implemente testes unitários que cubram casos-limite (strings vazias, máximo esperado, acima do máximo).

CVE-2026-49841CRITICALFreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body readEPSS 0.4%CVE-2026-42915MEDIUMMicrosoft Windows VMSwitch Denial of Service VulnerabilityEPSS 0.4%CVE-2026-52955CRITICALlibceph: Fix potential out-of-bounds access in crush_decode()EPSS 0.4%CVE-2026-70457HIGHrsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()EPSS 0.4%CVE-2026-29004HIGHBusyBox DHCPv6 Client Heap Buffer Overflow via DNS_SERVERSEPSS 0.4%CVE-2026-44223MEDIUMvLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parametersEPSS 0.4%CVE-2025-55297MEDIUMESF-IDF BluFi Example Memory Overflow VulnerabilityEPSS 0.4%CVE-2025-0395MEDIUMWhen the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure mesEPSS 0.4%CVE-2022-25731HIGHIncorrect Calculation of Buffer Size in MODEMEPSS 0.4%CVE-2026-88830HIGHBusybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflowEPSS 0.4%CVE-2026-11604MEDIUMAn incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authentiEPSS 0.3%CVE-2026-0280LOWPAN-OS: IPv6 Firewall Policy BypassEPSS 0.3%CVE-2026-20049HIGHA vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic of Cisco SecuEPSS 0.3%CVE-2025-46688MEDIUMquickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS bEPSS 0.3%CVE-2026-40618HIGHBIG-IP SSL/TLS vulnerabilityEPSS 0.3%CVE-2022-2873—An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the IEPSS 0.3%CVE-2025-52955HIGHJunos OS and Junos OS Evolved: When jflow/sflow is configured continuous logical interface flaps causes rpd crash and restartEPSS 0.3%CVE-2026-95509HIGHOut-of-bounds read vulnerability in string formatting impacts Qt for MCUsEPSS 0.3%CVE-2025-33126MEDIUMFixes to common vulnerabilities found in IBM Db2 High Performance UnloadEPSS 0.3%CVE-2026-6752HIGHIncorrect boundary conditions in the WebRTC componentEPSS 0.3%