Falhas do tipo CWE-131

190 resultados

Cálculo incorreto do tamanho de buffer

Ocorre quando o código calcula erroneamente a quantidade de memória necessária para um buffer, resultando em alocação insuficiente. Um atacante pode explorar isso para escrever dados além dos limites (buffer overflow), corrompendo memória adjacente, causando crash ou execução de código arbitrário.

Exemplo

Um programa lê uma string de entrada e aloca espaço multiplicando o número de caracteres por sizeof(char), mas esquece de considerar o terminador nulo, ou miscalcula o tamanho total em uma operação aritmética complexa. Quando copia a string para o buffer, ela transborda e sobrescreve variáveis críticas da pilha.

Como mitigar

Use funções seguras de alocação que validem o tamanho (como safe_malloc em C), sempre inclua o espaço para terminadores e metadados, e teste o cálculo com valores extremos. Em linguagens de alto nível (Python, Java, Go), prefira usar estruturas dinâmicas que gerenciam tamanho automaticamente.

CVE-2026-49841CRITICALFreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body readEPSS 0.4%CVE-2026-42915MEDIUMMicrosoft Windows VMSwitch Denial of Service VulnerabilityEPSS 0.4%CVE-2026-52955CRITICALlibceph: Fix potential out-of-bounds access in crush_decode()EPSS 0.4%CVE-2026-70457HIGHrsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()EPSS 0.4%CVE-2026-29004HIGHBusyBox DHCPv6 Client Heap Buffer Overflow via DNS_SERVERSEPSS 0.4%CVE-2026-44223MEDIUMvLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parametersEPSS 0.4%CVE-2025-55297MEDIUMESF-IDF BluFi Example Memory Overflow VulnerabilityEPSS 0.4%CVE-2025-0395MEDIUMWhen the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure mesEPSS 0.4%CVE-2022-25731HIGHIncorrect Calculation of Buffer Size in MODEMEPSS 0.4%CVE-2026-88830HIGHBusybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflowEPSS 0.4%CVE-2026-11604MEDIUMAn incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authentiEPSS 0.3%CVE-2026-0280LOWPAN-OS: IPv6 Firewall Policy BypassEPSS 0.3%CVE-2026-20049HIGHA vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic of Cisco SecuEPSS 0.3%CVE-2025-46688MEDIUMquickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS bEPSS 0.3%CVE-2026-40618HIGHBIG-IP SSL/TLS vulnerabilityEPSS 0.3%CVE-2022-2873—An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the IEPSS 0.3%CVE-2025-52955HIGHJunos OS and Junos OS Evolved: When jflow/sflow is configured continuous logical interface flaps causes rpd crash and restartEPSS 0.3%CVE-2026-95509HIGHOut-of-bounds read vulnerability in string formatting impacts Qt for MCUsEPSS 0.3%CVE-2025-33126MEDIUMFixes to common vulnerabilities found in IBM Db2 High Performance UnloadEPSS 0.3%CVE-2026-6752HIGHIncorrect boundary conditions in the WebRTC componentEPSS 0.3%