Falhas do tipo CWE-131

163 resultados

Cálculo incorreto do tamanho de buffer

Ocorre quando o código calcula erroneamente a quantidade de memória necessária para um buffer, resultando em alocação insuficiente. Um atacante pode explorar isso para escrever dados além dos limites (buffer overflow), corrompendo memória adjacente, causando crash ou execução de código arbitrário.

Exemplo

Um programa lê uma string de entrada e aloca espaço multiplicando o número de caracteres por sizeof(char), mas esquece de considerar o terminador nulo, ou miscalcula o tamanho total em uma operação aritmética complexa. Quando copia a string para o buffer, ela transborda e sobrescreve variáveis críticas da pilha.

Como mitigar

Use funções seguras de alocação que validem o tamanho (como safe_malloc em C), sempre inclua o espaço para terminadores e metadados, e teste o cálculo com valores extremos. Em linguagens de alto nível (Python, Java, Go), prefira usar estruturas dinâmicas que gerenciam tamanho automaticamente.

CVE-2026-40618HIGHBIG-IP SSL/TLS vulnerabilityEPSS 0.3%CVE-2022-2873—An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the IEPSS 0.3%CVE-2025-46688MEDIUMquickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS bEPSS 0.3%CVE-2026-6752HIGHIncorrect boundary conditions in the WebRTC componentEPSS 0.3%CVE-2026-10701HIGHIncorrect boundary conditions in the Graphics: Text componentEPSS 0.3%CVE-2021-4155—A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A EPSS 0.3%CVE-2025-57807LOWImageMagick BlobStream Forward-Seek Under-AllocationEPSS 0.3%CVE-2026-20049HIGHA vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic of Cisco SecuEPSS 0.3%CVE-2025-33126MEDIUMFixes to common vulnerabilities found in IBM Db2 High Performance UnloadEPSS 0.3%CVE-2026-41676HIGHrust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1EPSS 0.3%CVE-2026-22791MEDIUMopenCryptoki incorrectly calculates the buffer size in C_WrapKey with CKM_ECDH_AES_KEY_WRAPEPSS 0.3%CVE-2025-52955HIGHJunos OS and Junos OS Evolved: When jflow/sflow is configured continuous logical interface flaps causes rpd crash and restartEPSS 0.3%CVE-2026-33986HIGHFreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB WriteEPSS 0.3%CVE-2026-67549HIGHOpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds writeEPSS 0.3%CVE-2021-29529LOWHeap buffer overflow caused by roundingEPSS 0.3%CVE-2025-33216MEDIUMNVIDIA SNAP-4 Container contains a vulnerability in the configuration interface where an attacker on a VM may cause an incorrect calculationEPSS 0.3%CVE-2025-33124MEDIUMFixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and WindowsEPSS 0.2%CVE-2026-91962MEDIUMFreeRDP before 3.31.0 Integer Overflow via audin Apple backendsEPSS 0.2%CVE-2021-29608MEDIUMHeap OOB and null pointer dereference in `RaggedTensorToTensor`EPSS 0.2%CVE-2024-39808MEDIUMIncorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows an attacker with phyEPSS 0.2%