Weaknesses of type CWE-131

190 results

Cálculo incorreto do tamanho de buffer

O desenvolvedor calcula errado quantos bytes um buffer precisa armazenar, geralmente por erro de lógica matemática, confundindo unidades (bytes vs. elementos) ou não contando caracteres especiais como nulo terminador. Isso abre espaço para estouro de buffer quando dados maiores que o esperado são copiados para esse espaço insuficiente.

Example

Um programa aloca espaço para uma string com `malloc(strlen(entrada))` esquecendo o byte do nulo terminador; quando copia a string com `strcpy()`, escreve além dos limites alocados. Ou calcula `tamanho = num_elementos * 4` quando deveria ser `num_elementos * sizeof(tipo)`.

How to mitigate

Use funções seguras como `snprintf()` ou `strncpy()` que respeitam limites; valide o tamanho final antes de alocar memória; prefira bibliotecas de string seguras; implemente testes unitários que cubram casos-limite (strings vazias, máximo esperado, acima do máximo).

CVE-2026-53143HIGHdrm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11EPSS 0.2%CVE-2026-47773HIGHArduinoBLE: Memory corruption via malformed ATT write requestEPSS 0.1%CVE-2026-112008MEDIUMlibmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordrEPSS 0.1%CVE-2026-95111MEDIUMModule queue front-send validates a word count as a byte countEPSS 0.1%CVE-2026-53091HIGHnet: pull headers in qdisc_pkt_len_segs_init()EPSS 0.1%CVE-2025-71286HIGHASoC: SOF: ipc4-topology: Correct the allocation size for bytes controlsEPSS 0.1%CVE-2026-18743LOWPopt-devel: popt-static: short realloc in poptconfigfiletostringEPSS 0.1%CVE-2026-47578HIGHNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect buffer siEPSS 0.1%CVE-2022-32630MEDIUMIn throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation oEPSS 0.1%CVE-2026-45784MEDIUMrust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphersEPSS 0.1%CVE-2026-2738MEDIUMBuffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peerEPSS 0.1%CVE-2026-42169HIGHGimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)EPSS 0.1%CVE-2026-28686MEDIUMImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output bufferEPSS 0.1%CVE-2026-116737MEDIUMlibphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File PathEPSS 0.1%CVE-2026-107590LOWOut-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts QtEPSS 0.1%CVE-2026-102729MEDIUM`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with EPSS 0.1%CVE-2026-78221MEDIUMAn incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated usersEPSS 0.1%CVE-2026-46521MEDIUMImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compressionEPSS 0.1%CVE-2026-13466HIGHUnit Confusion in VAB AuthenticationEPSS 0.1%CVE-2022-32649MEDIUMIn jpeg, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution priEPSS 0.1%