Weaknesses of type CWE-131

146 results

Cálculo incorreto do tamanho de buffer

O desenvolvedor calcula errado quantos bytes um buffer precisa armazenar, geralmente por erro de lógica matemática, confundindo unidades (bytes vs. elementos) ou não contando caracteres especiais como nulo terminador. Isso abre espaço para estouro de buffer quando dados maiores que o esperado são copiados para esse espaço insuficiente.

Example

Um programa aloca espaço para uma string com `malloc(strlen(entrada))` esquecendo o byte do nulo terminador; quando copia a string com `strcpy()`, escreve além dos limites alocados. Ou calcula `tamanho = num_elementos * 4` quando deveria ser `num_elementos * sizeof(tipo)`.

How to mitigate

Use funções seguras como `snprintf()` ou `strncpy()` que respeitam limites; valide o tamanho final antes de alocar memória; prefira bibliotecas de string seguras; implemente testes unitários que cubram casos-limite (strings vazias, máximo esperado, acima do máximo).

CVE-2023-36824HIGHHeap overflow in COMMAND GETKEYS and ACL evaluation in RedisEPSS 77.4%CVE-2026-42945CRITICALNGINX ngx_http_rewrite_module vulnerabilityEPSS 66.0%CVE-2022-43945HIGHThe Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages EPSS 21.3%CVE-2005-2103CRITICALBuffer overflow in the AIM and ICQ module in Gaim before 1.5.0 allows remote attackers to cause a denial of service (application crash) and EPSS 16.1%CVE-2018-14618HIGHcurl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hasEPSS 11.1%CVE-2020-17087HIGHWindows Kernel Local Elevation of Privilege VulnerabilityEPSS 5.4%KEVCVE-2019-5435An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.EPSS 4.9%CVE-2026-42055CRITICALNGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerabilityEPSS 4.0%CVE-2026-44420HIGHFreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPSEPSS 3.7%CVE-2023-6780MEDIUMGlibc: integer overflow in __vsyslog_internal()EPSS 2.7%CVE-2021-0254CRITICALJunos OS: Remote code execution vulnerability in overlayd serviceEPSS 2.6%CVE-2020-6108HIGHAn exploitable code execution vulnerability exists in the fsck_chk_orphan_node functionality of F2fs-Tools F2fs.Fsck 1.13. A specially craftEPSS 2.2%CVE-2022-31630MEDIUMOOB read due to insufficient input validation in imageloadfont()EPSS 2.2%CVE-2020-13585CRITICALAn out-of-bounds write vulnerability exists in the PSD Header processing functionality of Accusoft ImageGear 19.8. A specially crafted malfoEPSS 1.9%CVE-2024-23622CRITICALIBM Merge Healthcare eFilm Workstation License Server CopySLS_Request3 Buffer OverflowEPSS 1.9%CVE-2024-23621CRITICALIBM Merge Healthcare eFilm Workstation License Server Buffer OverflowEPSS 1.9%CVE-2024-23606CRITICALAn out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (aEPSS 1.7%CVE-2004-0747HIGHBuffer overflow in Apache 2.0.50 and earlier allows local users to gain apache privileges via a .htaccess file that causes the overflow duriEPSS 1.6%CVE-2020-6106MEDIUMAn exploitable information disclosure vulnerability exists in the init_node_manager functionality of F2fs-Tools F2fs.Fsck 1.12 and 1.13. A sEPSS 1.5%CVE-2021-38435MEDIUMRTI Connext DDS Professional and Connext DDS Secure Incorrect Calculation of Buffer SizeEPSS 1.4%