Weaknesses of type CWE-131

163 results

Cálculo incorreto do tamanho de buffer

O desenvolvedor calcula errado quantos bytes um buffer precisa armazenar, geralmente por erro de lógica matemática, confundindo unidades (bytes vs. elementos) ou não contando caracteres especiais como nulo terminador. Isso abre espaço para estouro de buffer quando dados maiores que o esperado são copiados para esse espaço insuficiente.

Example

Um programa aloca espaço para uma string com `malloc(strlen(entrada))` esquecendo o byte do nulo terminador; quando copia a string com `strcpy()`, escreve além dos limites alocados. Ou calcula `tamanho = num_elementos * 4` quando deveria ser `num_elementos * sizeof(tipo)`.

How to mitigate

Use funções seguras como `snprintf()` ou `strncpy()` que respeitam limites; valide o tamanho final antes de alocar memória; prefira bibliotecas de string seguras; implemente testes unitários que cubram casos-limite (strings vazias, máximo esperado, acima do máximo).

CVE-2026-8357MEDIUMHeap buffer overflow in Calc formula compilationEPSS 0.2%CVE-2022-32618MEDIUMIn typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of priEPSS 0.2%CVE-2021-29535LOWHeap buffer overflow in `QuantizedMul`EPSS 0.2%CVE-2022-32617MEDIUMIn typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of priEPSS 0.2%CVE-2021-29536LOWHeap buffer overflow in `QuantizedReshape`EPSS 0.2%CVE-2021-29537LOWHeap buffer overflow in `QuantizedResizeBilinear`EPSS 0.2%CVE-2026-33985MEDIUMFreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB ReadEPSS 0.2%CVE-2021-29542LOWHeap buffer overflow in `StringNGrams`EPSS 0.2%CVE-2026-40918MEDIUMGimp: gimp: denial of service via crafted pvr image fileEPSS 0.2%CVE-2025-61661MEDIUMGrub2: grub2: out-of-bounds write via malicious usb deviceEPSS 0.2%CVE-2021-29545LOWHeap buffer overflow in `SparseTensorToCSRSparseMatrix`EPSS 0.2%CVE-2021-29521LOWSegfault in SparseCountSparseOutputEPSS 0.2%CVE-2026-21503MEDIUMiccDEV has Undefined Behavior - Null Pointer Passed to memcpy() in CIccTagSparseMatrixArrayEPSS 0.2%CVE-2019-25555MEDIUMTwistedBrush Pro Studio 24.06 Script Recorder Denial of ServiceEPSS 0.2%CVE-2026-42170HIGHGimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_layer() (ddsread.c)EPSS 0.2%CVE-2026-53143HIGHdrm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11EPSS 0.2%CVE-2026-54692HIGHSAIL: XBM X10 decoder writes 2 bytes per literal into a 1-byte-per-literal buffer (heap out-of-bounds write)EPSS 0.1%CVE-2026-18743LOWPopt-devel: popt-static: short realloc in poptconfigfiletostringEPSS 0.1%CVE-2026-53091HIGHnet: pull headers in qdisc_pkt_len_segs_init()EPSS 0.1%CVE-2022-32630MEDIUMIn throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation oEPSS 0.1%