Falhas do tipo CWE-131

146 resultados

Cálculo incorreto do tamanho de buffer

Ocorre quando o código calcula erroneamente a quantidade de memória necessária para um buffer, resultando em alocação insuficiente. Um atacante pode explorar isso para escrever dados além dos limites (buffer overflow), corrompendo memória adjacente, causando crash ou execução de código arbitrário.

Exemplo

Um programa lê uma string de entrada e aloca espaço multiplicando o número de caracteres por sizeof(char), mas esquece de considerar o terminador nulo, ou miscalcula o tamanho total em uma operação aritmética complexa. Quando copia a string para o buffer, ela transborda e sobrescreve variáveis críticas da pilha.

Como mitigar

Use funções seguras de alocação que validem o tamanho (como safe_malloc em C), sempre inclua o espaço para terminadores e metadados, e teste o cálculo com valores extremos. Em linguagens de alto nível (Python, Java, Go), prefira usar estruturas dinâmicas que gerenciam tamanho automaticamente.

CVE-2023-36824HIGHHeap overflow in COMMAND GETKEYS and ACL evaluation in RedisEPSS 77.4%CVE-2026-42945CRITICALNGINX ngx_http_rewrite_module vulnerabilityEPSS 66.0%CVE-2022-43945HIGHThe Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages EPSS 21.3%CVE-2005-2103CRITICALBuffer overflow in the AIM and ICQ module in Gaim before 1.5.0 allows remote attackers to cause a denial of service (application crash) and EPSS 16.1%CVE-2018-14618HIGHcurl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hasEPSS 11.1%CVE-2020-17087HIGHWindows Kernel Local Elevation of Privilege VulnerabilityEPSS 5.4%KEVCVE-2019-5435An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.EPSS 4.9%CVE-2026-42055CRITICALNGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerabilityEPSS 4.0%CVE-2026-44420HIGHFreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPSEPSS 3.7%CVE-2023-6780MEDIUMGlibc: integer overflow in __vsyslog_internal()EPSS 2.7%CVE-2021-0254CRITICALJunos OS: Remote code execution vulnerability in overlayd serviceEPSS 2.6%CVE-2020-6108HIGHAn exploitable code execution vulnerability exists in the fsck_chk_orphan_node functionality of F2fs-Tools F2fs.Fsck 1.13. A specially craftEPSS 2.2%CVE-2022-31630MEDIUMOOB read due to insufficient input validation in imageloadfont()EPSS 2.2%CVE-2020-13585CRITICALAn out-of-bounds write vulnerability exists in the PSD Header processing functionality of Accusoft ImageGear 19.8. A specially crafted malfoEPSS 1.9%CVE-2024-23621CRITICALIBM Merge Healthcare eFilm Workstation License Server Buffer OverflowEPSS 1.9%CVE-2024-23622CRITICALIBM Merge Healthcare eFilm Workstation License Server CopySLS_Request3 Buffer OverflowEPSS 1.9%CVE-2024-23606CRITICALAn out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (aEPSS 1.7%CVE-2004-0747HIGHBuffer overflow in Apache 2.0.50 and earlier allows local users to gain apache privileges via a .htaccess file that causes the overflow duriEPSS 1.6%CVE-2020-6106MEDIUMAn exploitable information disclosure vulnerability exists in the init_node_manager functionality of F2fs-Tools F2fs.Fsck 1.12 and 1.13. A sEPSS 1.5%CVE-2021-38435MEDIUMRTI Connext DDS Professional and Connext DDS Secure Incorrect Calculation of Buffer SizeEPSS 1.4%