Falhas do tipo CWE-131

190 resultados

Cálculo incorreto do tamanho de buffer

Ocorre quando o código calcula erroneamente a quantidade de memória necessária para um buffer, resultando em alocação insuficiente. Um atacante pode explorar isso para escrever dados além dos limites (buffer overflow), corrompendo memória adjacente, causando crash ou execução de código arbitrário.

Exemplo

Um programa lê uma string de entrada e aloca espaço multiplicando o número de caracteres por sizeof(char), mas esquece de considerar o terminador nulo, ou miscalcula o tamanho total em uma operação aritmética complexa. Quando copia a string para o buffer, ela transborda e sobrescreve variáveis críticas da pilha.

Como mitigar

Use funções seguras de alocação que validem o tamanho (como safe_malloc em C), sempre inclua o espaço para terminadores e metadados, e teste o cálculo com valores extremos. Em linguagens de alto nível (Python, Java, Go), prefira usar estruturas dinâmicas que gerenciam tamanho automaticamente.

CVE-2026-53143HIGHdrm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11EPSS 0.2%CVE-2026-47773HIGHArduinoBLE: Memory corruption via malformed ATT write requestEPSS 0.1%CVE-2026-112008MEDIUMlibmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordrEPSS 0.1%CVE-2026-18743LOWPopt-devel: popt-static: short realloc in poptconfigfiletostringEPSS 0.1%CVE-2026-95111MEDIUMModule queue front-send validates a word count as a byte countEPSS 0.1%CVE-2026-53091HIGHnet: pull headers in qdisc_pkt_len_segs_init()EPSS 0.1%CVE-2025-71286HIGHASoC: SOF: ipc4-topology: Correct the allocation size for bytes controlsEPSS 0.1%CVE-2026-47578HIGHNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect buffer siEPSS 0.1%CVE-2022-32630MEDIUMIn throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation oEPSS 0.1%CVE-2026-45784MEDIUMrust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphersEPSS 0.1%CVE-2026-2738MEDIUMBuffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peerEPSS 0.1%CVE-2026-42169HIGHGimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)EPSS 0.1%CVE-2026-28686MEDIUMImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output bufferEPSS 0.1%CVE-2026-116737MEDIUMlibphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File PathEPSS 0.1%CVE-2026-107590LOWOut-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts QtEPSS 0.1%CVE-2026-102729MEDIUM`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with EPSS 0.1%CVE-2026-78221MEDIUMAn incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated usersEPSS 0.1%CVE-2026-46521MEDIUMImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compressionEPSS 0.1%CVE-2026-13466HIGHUnit Confusion in VAB AuthenticationEPSS 0.1%CVE-2022-32649MEDIUMIn jpeg, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution priEPSS 0.1%