Fallos del tipo CWE-131

162 resultados

Cálculo Incorreto de Tamanho de Buffer

Ocorre quando o desenvolvedor calcula de forma errada o tamanho de memória necessária para um buffer, resultando em alocação insuficiente. Isso permite que dados escritos ultrapassem o limite do buffer, causando corrupção de memória, crash ou execução de código arbitrário.

Ejemplo

Um programa recebe uma string de tamanho desconhecido e aloca buffer com `malloc(strlen(input))` em vez de `malloc(strlen(input) + 1)`. O espaço para o terminador nulo é esquecido, e a cópia transborda o buffer adjacente.

Cómo mitigar

Use funções seguras como `snprintf()` ou `strncpy()` que aceitam o tamanho máximo como parâmetro. Ao calcular tamanho, sempre considere: comprimento real dos dados + espaço para terminadores + padding necessário. Automatize com ferramentas estáticas (AddressSanitizer, Valgrind) em testes para detectar transbordamentos.

CVE-2026-42169HIGHGimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)EPSS 0.1%CVE-2026-45784MEDIUMrust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphersEPSS 0.1%CVE-2026-52834HIGHjxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platformsEPSS 0.1%CVE-2026-65705HIGHFFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame()EPSS 0.1%CVE-2026-65706HIGHFFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame ProcessingEPSS 0.1%CVE-2026-84448MEDIUMlibheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)EPSS 0.1%CVE-2026-2738MEDIUMBuffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peerEPSS 0.1%CVE-2026-78221MEDIUMAn incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated usersEPSS 0.1%CVE-2026-28686MEDIUMImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output bufferEPSS 0.1%CVE-2026-46521MEDIUMImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compressionEPSS 0.1%CVE-2026-47773HIGHArduinoBLE: Memory corruption via malformed ATT write requestEPSS 0.1%CVE-2022-32649MEDIUMIn jpeg, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution priEPSS 0.1%CVE-2026-33987HIGHFreeRDP: Persistent Cache bmpSize Desync - Heap OOB WriteEPSS 0.1%CVE-2022-32650MEDIUMIn mtk-isp, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution EPSS 0.1%CVE-2022-32651MEDIUMIn mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution EPSS 0.1%CVE-2022-32624MEDIUMIn throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation oEPSS 0.1%CVE-2017-13315HIGHIn writeToParcel and createFromParcel of DcParamObject.java, there is a permission bypass due to a write size mismatch. This could lead to aEPSS 0.1%CVE-2023-20627MEDIUMIn pqframework, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege withEPSS 0.1%CVE-2024-27237MEDIUMIn wipe_ns_memory of nsmemwipe.c, there is a possible incorrect size calculation due to a logic error in the code. This could lead to local EPSS 0.1%CVE-2025-27053HIGHIncorrect Calculation of Buffer Size in HLOSEPSS 0.1%