Weaknesses of type CWE-131

164 results

Cálculo incorreto do tamanho de buffer

O desenvolvedor calcula errado quantos bytes um buffer precisa armazenar, geralmente por erro de lógica matemática, confundindo unidades (bytes vs. elementos) ou não contando caracteres especiais como nulo terminador. Isso abre espaço para estouro de buffer quando dados maiores que o esperado são copiados para esse espaço insuficiente.

Example

Um programa aloca espaço para uma string com `malloc(strlen(entrada))` esquecendo o byte do nulo terminador; quando copia a string com `strcpy()`, escreve além dos limites alocados. Ou calcula `tamanho = num_elementos * 4` quando deveria ser `num_elementos * sizeof(tipo)`.

How to mitigate

Use funções seguras como `snprintf()` ou `strncpy()` que respeitam limites; valide o tamanho final antes de alocar memória; prefira bibliotecas de string seguras; implemente testes unitários que cubram casos-limite (strings vazias, máximo esperado, acima do máximo).

CVE-2026-45784MEDIUMrust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphersEPSS 0.1%CVE-2026-42169HIGHGimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)EPSS 0.1%CVE-2026-52834HIGHjxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platformsEPSS 0.1%CVE-2026-65706HIGHFFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame ProcessingEPSS 0.1%CVE-2026-65705HIGHFFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame()EPSS 0.1%CVE-2026-84448MEDIUMlibheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)EPSS 0.1%CVE-2026-2738MEDIUMBuffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peerEPSS 0.1%CVE-2026-78221MEDIUMAn incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated usersEPSS 0.1%CVE-2026-28686MEDIUMImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output bufferEPSS 0.1%CVE-2026-46521MEDIUMImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compressionEPSS 0.1%CVE-2022-32649MEDIUMIn jpeg, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution priEPSS 0.1%CVE-2026-47773HIGHArduinoBLE: Memory corruption via malformed ATT write requestEPSS 0.1%CVE-2026-33987HIGHFreeRDP: Persistent Cache bmpSize Desync - Heap OOB WriteEPSS 0.1%CVE-2022-32650MEDIUMIn mtk-isp, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution EPSS 0.1%CVE-2022-32651MEDIUMIn mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution EPSS 0.1%CVE-2022-32624MEDIUMIn throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation oEPSS 0.1%CVE-2017-13315HIGHIn writeToParcel and createFromParcel of DcParamObject.java, there is a permission bypass due to a write size mismatch. This could lead to aEPSS 0.1%CVE-2023-20627MEDIUMIn pqframework, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege withEPSS 0.1%CVE-2024-27237MEDIUMIn wipe_ns_memory of nsmemwipe.c, there is a possible incorrect size calculation due to a logic error in the code. This could lead to local EPSS 0.1%CVE-2025-27053HIGHIncorrect Calculation of Buffer Size in HLOSEPSS 0.1%