Falhas do tipo CWE-193

127 resultados

Erro de Limite de Fora por Um (Off-by-One)

Um erro de lógica onde um loop, índice de array ou comparação numérica erra por exatamente uma unidade, acessando posição inválida de memória ou pulando uma iteração crítica. Isso causa corrupção de dados, leitura além dos limites ou execução incorreta de lógica sensível.

Exemplo

Um loop que deveria processar 100 elementos (índices 0-99) itera até 100 inclusive, tentando acessar o índice 100 que não existe. Ou um verificador que compara `if (tamanho <= 256)` quando deveria ser `<`, deixando passar um byte além do permitido.

Como mitigar

Use idiomas seguros: iteradores de linguagens modernas (for-each), funções de biblioteca que já tratam limites, e valide explicitamente ranges antes de loops. Em código crítico, teste cases nas bordas (0, 1, tamanho-1, tamanho) e use análise estática que detecta comparações suspeitas.

CVE-2026-4887MEDIUMGimp: gimp:memory disclosure and denial of service via specially crafted pcx imageEPSS 0.6%CVE-2023-27477LOWwasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the EPSS 0.6%CVE-2026-12413HIGHIKEv2 Denial of Service via malformed fragmentationEPSS 0.6%CVE-2026-56787MEDIUMRTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR MessageEPSS 0.6%CVE-2025-43973MEDIUMAn issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in whEPSS 0.6%CVE-2006-10003CRITICALXML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stackEPSS 0.5%CVE-2025-43971HIGHAn issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionEPSS 0.5%CVE-2026-54410HIGHnanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length FieldEPSS 0.5%CVE-2026-43964LOWPostfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced statuEPSS 0.5%CVE-2026-49127HIGHMusic Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24beEPSS 0.5%CVE-2026-52804MEDIUMGogs: Privilege Escalation via Collaboration Access Mode ValidationEPSS 0.5%CVE-2026-44042LOWUltraVNC repeater wi_uudecode off-by-one in base64 decode boundary checkEPSS 0.5%CVE-2026-31988MEDIUMyauzl 3.2.0 - Denial of Service via Off-by-One Error in NTFS Timestamp ParserEPSS 0.5%CVE-2024-45796MEDIUMSuricata defrag: off by one can lead to policy bypassEPSS 0.5%CVE-2026-32605HIGHNimiq: Remote crash via off-by-one signer bounds check in proposal bufferEPSS 0.5%CVE-2017-2618MEDIUMA flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty (null) write EPSS 0.5%CVE-2025-47711MEDIUMNbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of serviceEPSS 0.5%CVE-2025-30742MEDIUMhttpd.c in atophttpd 2.8.0 has an off-by-one error and resultant out-of-bounds read because a certain 1024-character req string would not haEPSS 0.4%CVE-2022-3821MEDIUMAn off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values fEPSS 0.4%CVE-2026-81396HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.4%