Weaknesses of type CWE-131

190 results

Cálculo incorreto do tamanho de buffer

O desenvolvedor calcula errado quantos bytes um buffer precisa armazenar, geralmente por erro de lógica matemática, confundindo unidades (bytes vs. elementos) ou não contando caracteres especiais como nulo terminador. Isso abre espaço para estouro de buffer quando dados maiores que o esperado são copiados para esse espaço insuficiente.

Example

Um programa aloca espaço para uma string com `malloc(strlen(entrada))` esquecendo o byte do nulo terminador; quando copia a string com `strcpy()`, escreve além dos limites alocados. Ou calcula `tamanho = num_elementos * 4` quando deveria ser `num_elementos * sizeof(tipo)`.

How to mitigate

Use funções seguras como `snprintf()` ou `strncpy()` que respeitam limites; valide o tamanho final antes de alocar memória; prefira bibliotecas de string seguras; implemente testes unitários que cubram casos-limite (strings vazias, máximo esperado, acima do máximo).

CVE-2021-29535LOWHeap buffer overflow in `QuantizedMul`EPSS 0.2%CVE-2021-29536LOWHeap buffer overflow in `QuantizedReshape`EPSS 0.2%CVE-2021-29537LOWHeap buffer overflow in `QuantizedResizeBilinear`EPSS 0.2%CVE-2026-82944HIGHBuffer Overflow in CoE SDO Upload Multi-Segment Data TransfersEPSS 0.2%CVE-2025-61661MEDIUMGrub2: grub2: out-of-bounds write via malicious usb deviceEPSS 0.2%CVE-2026-106574MEDIUMImageMagick: Heap Buffer Over-Write in distributed pixel cache server will result in a crashEPSS 0.2%CVE-2026-86563HIGHDpdk: dpdk: double offset bug in vhost log mapping calculationEPSS 0.2%CVE-2021-29542LOWHeap buffer overflow in `StringNGrams`EPSS 0.2%CVE-2026-40918MEDIUMGimp: gimp: denial of service via crafted pvr image fileEPSS 0.2%CVE-2026-54692HIGHSAIL: XBM X10 decoder writes 2 bytes per literal into a 1-byte-per-literal buffer (heap out-of-bounds write)EPSS 0.2%CVE-2026-42170HIGHGimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_layer() (ddsread.c)EPSS 0.2%CVE-2026-21503MEDIUMiccDEV has Undefined Behavior - Null Pointer Passed to memcpy() in CIccTagSparseMatrixArrayEPSS 0.2%CVE-2021-29521LOWSegfault in SparseCountSparseOutputEPSS 0.2%CVE-2021-29545LOWHeap buffer overflow in `SparseTensorToCSRSparseMatrix`EPSS 0.2%CVE-2026-65705HIGHFFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame()EPSS 0.2%CVE-2026-65706HIGHFFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame ProcessingEPSS 0.2%CVE-2026-84448MEDIUMlibheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)EPSS 0.2%CVE-2019-25555MEDIUMTwistedBrush Pro Studio 24.06 Script Recorder Denial of ServiceEPSS 0.2%CVE-2026-52834HIGHjxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platformsEPSS 0.2%CVE-2026-53366HIGHipv4: account for fraggap on the paged allocation pathEPSS 0.2%