Falhas do tipo CWE-131

162 resultados

Cálculo incorreto do tamanho de buffer

Ocorre quando o código calcula erroneamente a quantidade de memória necessária para um buffer, resultando em alocação insuficiente. Um atacante pode explorar isso para escrever dados além dos limites (buffer overflow), corrompendo memória adjacente, causando crash ou execução de código arbitrário.

Exemplo

Um programa lê uma string de entrada e aloca espaço multiplicando o número de caracteres por sizeof(char), mas esquece de considerar o terminador nulo, ou miscalcula o tamanho total em uma operação aritmética complexa. Quando copia a string para o buffer, ela transborda e sobrescreve variáveis críticas da pilha.

Como mitigar

Use funções seguras de alocação que validem o tamanho (como safe_malloc em C), sempre inclua o espaço para terminadores e metadados, e teste o cálculo com valores extremos. Em linguagens de alto nível (Python, Java, Go), prefira usar estruturas dinâmicas que gerenciam tamanho automaticamente.

CVE-2026-42169HIGHGimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)EPSS 0.1%CVE-2026-45784MEDIUMrust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphersEPSS 0.1%CVE-2026-52834HIGHjxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platformsEPSS 0.1%CVE-2026-65705HIGHFFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame()EPSS 0.1%CVE-2026-65706HIGHFFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame ProcessingEPSS 0.1%CVE-2026-84448MEDIUMlibheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)EPSS 0.1%CVE-2026-2738MEDIUMBuffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peerEPSS 0.1%CVE-2026-78221MEDIUMAn incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated usersEPSS 0.1%CVE-2026-28686MEDIUMImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output bufferEPSS 0.1%CVE-2026-46521MEDIUMImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compressionEPSS 0.1%CVE-2026-47773HIGHArduinoBLE: Memory corruption via malformed ATT write requestEPSS 0.1%CVE-2022-32649MEDIUMIn jpeg, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution priEPSS 0.1%CVE-2026-33987HIGHFreeRDP: Persistent Cache bmpSize Desync - Heap OOB WriteEPSS 0.1%CVE-2022-32650MEDIUMIn mtk-isp, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution EPSS 0.1%CVE-2022-32651MEDIUMIn mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution EPSS 0.1%CVE-2022-32624MEDIUMIn throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation oEPSS 0.1%CVE-2017-13315HIGHIn writeToParcel and createFromParcel of DcParamObject.java, there is a permission bypass due to a write size mismatch. This could lead to aEPSS 0.1%CVE-2023-20627MEDIUMIn pqframework, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege withEPSS 0.1%CVE-2024-27237MEDIUMIn wipe_ns_memory of nsmemwipe.c, there is a possible incorrect size calculation due to a logic error in the code. This could lead to local EPSS 0.1%CVE-2025-27053HIGHIncorrect Calculation of Buffer Size in HLOSEPSS 0.1%