Weaknesses of type CWE-130

106 results

Inconsistência no tratamento de parâmetros de comprimento

Ocorre quando o código não valida ou trata adequadamente inconsistências entre o comprimento declarado de um buffer/string e seu tamanho real. Um atacante explora essa discrepância para causar leitura ou escrita fora dos limites, levando a vazamento de dados, corrupção de memória ou execução de código.

Example

Uma função recebe uma string com um parâmetro 'length' que não corresponde ao tamanho real do buffer. Se o código copia 'length' bytes sem verificar se o buffer realmente possui esse tamanho, um memcpy() ou strcpy() escreve além do limite alocado, ou lê dados inválidos de memória adjacente.

How to mitigate

Sempre validar que o parâmetro de comprimento é coerente com o tamanho real do buffer antes de operações de cópia ou leitura. Use funções seguras (strncpy, memcpy_s) e implemente checks explícitos: se length > buffer_size, rejeitar ou truncar. Ferramentas de análise estática ajudam a detectar esse padrão.

CVE-2026-48685MEDIUMFastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly parses BGP path attributes with the extendEPSS 0.3%CVE-2026-9054CRITICALInvalid IP packets cause a kernel panicEPSS 0.3%CVE-2026-45681MEDIUMOpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB sizeEPSS 0.3%CVE-2026-22046HIGHiccDEV has heap-buffer-overflow in CIccProfileXml::ParseBasic() at IccXML/IccLibXML/IccProfileXml.cppEPSS 0.3%CVE-2026-41898HIGHrust-openssl: Unchecked callback-returned length in PSK and cookie generate trampolines can cause OpenSSL to leak adjacent memory to the network peerEPSS 0.3%CVE-2026-67292CRITICALFreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosureEPSS 0.3%CVE-2026-54466CRITICALwebsocket-driver: Message corruption via abuse of protocol length headersEPSS 0.3%CVE-2025-23247MEDIUMNVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a failure to check the length of a buffer coulEPSS 0.3%CVE-2025-52949HIGHJunos OS and Junos OS Evolved: In an EVPN environment, receipt of specifically malformed BGP update causes RPD crashEPSS 0.3%CVE-2021-26329—AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss EPSS 0.2%CVE-2026-62424MEDIUMbuffer overruns in libfsimage iso9660 handlingEPSS 0.2%CVE-2026-62423MEDIUMbuffer overruns in libfsimage iso9660 handlingEPSS 0.2%CVE-2026-48487MEDIUMZeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packetEPSS 0.2%CVE-2024-47293MEDIUMOut-of-bounds write vulnerability in the HAL-WIFI module Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.2%CVE-2026-45615HIGHmouse07410/asn1c: 1-byte Heap Out-of-Bounds Read in `INTEGER_decode_oer` via Malformed OER PayloadEPSS 0.2%CVE-2025-10458HIGHBluetooth: le_conn_rsp does not sanitize CID, MTU, MPS valuesEPSS 0.2%CVE-2026-60060MEDIUMImproper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm ProjecEPSS 0.2%CVE-2025-48022MEDIUMA vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciouEPSS 0.2%CVE-2026-34831MEDIUMRack: Content-Length mismatch in Rack::Files error responsesEPSS 0.1%CVE-2026-47692MEDIUMEnvoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application streamEPSS 0.1%