Weaknesses of type CWE-131

163 results

Cálculo incorreto do tamanho de buffer

O desenvolvedor calcula errado quantos bytes um buffer precisa armazenar, geralmente por erro de lógica matemática, confundindo unidades (bytes vs. elementos) ou não contando caracteres especiais como nulo terminador. Isso abre espaço para estouro de buffer quando dados maiores que o esperado são copiados para esse espaço insuficiente.

Example

Um programa aloca espaço para uma string com `malloc(strlen(entrada))` esquecendo o byte do nulo terminador; quando copia a string com `strcpy()`, escreve além dos limites alocados. Ou calcula `tamanho = num_elementos * 4` quando deveria ser `num_elementos * sizeof(tipo)`.

How to mitigate

Use funções seguras como `snprintf()` ou `strncpy()` que respeitam limites; valide o tamanho final antes de alocar memória; prefira bibliotecas de string seguras; implemente testes unitários que cubram casos-limite (strings vazias, máximo esperado, acima do máximo).

CVE-2026-40618HIGHBIG-IP SSL/TLS vulnerabilityEPSS 0.3%CVE-2025-46688MEDIUMquickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS bEPSS 0.3%CVE-2022-2873—An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the IEPSS 0.3%CVE-2026-6752HIGHIncorrect boundary conditions in the WebRTC componentEPSS 0.3%CVE-2026-10701HIGHIncorrect boundary conditions in the Graphics: Text componentEPSS 0.3%CVE-2021-4155—A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A EPSS 0.3%CVE-2025-57807LOWImageMagick BlobStream Forward-Seek Under-AllocationEPSS 0.3%CVE-2026-20049HIGHA vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic of Cisco SecuEPSS 0.3%CVE-2025-33126MEDIUMFixes to common vulnerabilities found in IBM Db2 High Performance UnloadEPSS 0.3%CVE-2026-41676HIGHrust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1EPSS 0.3%CVE-2026-22791MEDIUMopenCryptoki incorrectly calculates the buffer size in C_WrapKey with CKM_ECDH_AES_KEY_WRAPEPSS 0.3%CVE-2025-52955HIGHJunos OS and Junos OS Evolved: When jflow/sflow is configured continuous logical interface flaps causes rpd crash and restartEPSS 0.3%CVE-2026-33986HIGHFreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB WriteEPSS 0.3%CVE-2026-67549HIGHOpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds writeEPSS 0.3%CVE-2021-29529LOWHeap buffer overflow caused by roundingEPSS 0.3%CVE-2025-33216MEDIUMNVIDIA SNAP-4 Container contains a vulnerability in the configuration interface where an attacker on a VM may cause an incorrect calculationEPSS 0.3%CVE-2025-33124MEDIUMFixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and WindowsEPSS 0.2%CVE-2026-91962MEDIUMFreeRDP before 3.31.0 Integer Overflow via audin Apple backendsEPSS 0.2%CVE-2021-29608MEDIUMHeap OOB and null pointer dereference in `RaggedTensorToTensor`EPSS 0.2%CVE-2024-39808MEDIUMIncorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows an attacker with phyEPSS 0.2%