Falhas do tipo CWE-131

190 resultados

Cálculo incorreto do tamanho de buffer

Ocorre quando o código calcula erroneamente a quantidade de memória necessária para um buffer, resultando em alocação insuficiente. Um atacante pode explorar isso para escrever dados além dos limites (buffer overflow), corrompendo memória adjacente, causando crash ou execução de código arbitrário.

Exemplo

Um programa lê uma string de entrada e aloca espaço multiplicando o número de caracteres por sizeof(char), mas esquece de considerar o terminador nulo, ou miscalcula o tamanho total em uma operação aritmética complexa. Quando copia a string para o buffer, ela transborda e sobrescreve variáveis críticas da pilha.

Como mitigar

Use funções seguras de alocação que validem o tamanho (como safe_malloc em C), sempre inclua o espaço para terminadores e metadados, e teste o cálculo com valores extremos. Em linguagens de alto nível (Python, Java, Go), prefira usar estruturas dinâmicas que gerenciam tamanho automaticamente.

CVE-2026-4152HIGHGIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-62550HIGHAzure Monitor Agent Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-43501CRITICALipv6: rpl: reserve mac_len headroom when recompressed SRH growsEPSS 0.7%CVE-2026-4695HIGHIncorrect boundary conditions in the Audio/Video: Web Codecs componentEPSS 0.7%CVE-2026-2047HIGHGIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.7%CVE-2024-28052MEDIUMThe WBR-6012 is a wireless SOHO router. It is a low-cost device which functions as an internet gateway for homes and small offices while aimEPSS 0.7%CVE-2023-52558HIGHOpenBSD 7.4 and 7.3 m_split() network buffer kernel crashEPSS 0.7%CVE-2021-21773HIGHAn out-of-bounds write vulnerability exists in the TIFF header count-processing functionality of Accusoft ImageGear 19.8. A specially crafteEPSS 0.7%CVE-2026-45812MEDIUMApache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report HandlerEPSS 0.7%CVE-2026-31806CRITICALFreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap DimensionsEPSS 0.7%CVE-2026-39892MEDIUMcryptography has a buffer overflow if non-contiguous buffers were passed to APIsEPSS 0.7%CVE-2026-68287HIGHdrop_monitor: fix size calculations for 64-bit attributesEPSS 0.7%CVE-2026-34986HIGHGo JOSE affect by a panic in JWE decryptionEPSS 0.7%CVE-2026-57192MEDIUMAsterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count MismatchEPSS 0.7%CVE-2021-3491HIGHLinux kernel io_uring PROVIDE_BUFFERS MAX_RW_COUNT bypassEPSS 0.6%CVE-2026-20911CRITICALA heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A speEPSS 0.6%CVE-2026-97631CRITICALPre-boot RCE in EDK II PXE driverEPSS 0.6%CVE-2024-30405HIGHJunos OS: SRX 5000 Series with SPC2: Processing of specific crafted packets when ALG is enabled causes a transit traffic Denial of ServiceEPSS 0.6%CVE-2024-11425HIGHCWE-131: Incorrect Calculation of Buffer Size vulnerability exists that could cause Denial-of-Service of the product when an unauthenticatedEPSS 0.6%CVE-2026-2049HIGHGIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.6%