cve.bz

CWE-131: Incorrect Calculation of Buffer Size

Filter

The product does not correctly calculate the size to be used when allocating a buffer.

What the weakness is: CWE-131 at MITRE. All weaknesses

Related attack patterns (CAPEC): 2
  • CAPEC-47 Buffer Overflow via Parameter Expansion Likelihood: Medium · Severity: High
  • CAPEC-100 Overflow Buffers Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-131, as MITRE names them. Credits.

Ask an AI about CWE-131

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-131: Incorrect Calculation of Buffer Size and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/131.html and https://cve.bz/cve/cwe/131?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-91758EPSS 0.1%

    Out-of-bounds Read and Write Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.

  2. 7.5CVE-2026-120010EPSS 0.4%

    SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in af…

  3. 8.5CVE-2026-125233EPSS 0.1%

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in dvbsub_encode() in libavcodec/dvbsubenc.c that undercounts each CLUT segment header by two bytes. Attackers can supply a file with many bitmap subtitle rectangles that, …

  4. 7.3CVE-2026-125210EPSS 0.1%

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in aribcaption_trans_text_subtitle() in libavcodec/libaribcaption.c when decoding with sub_type text. Attackers can supply a crafted ARIB STD-B24 caption stream with zero r…

  5. 8.5CVE-2026-125209EPSS 0.1%

    FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the DVD subtitle encoder that underestimates RLE output size for odd-width rectangles. Attackers can supply files with crafted bitmap subtitles that,…

  6. 8.2CVE-2026-116788EPSS 0.4%

    FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replaceme…

  7. 7.5CVE-2026-116570EPSS 0.6%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, http_directory_auth() rebuilt an expect…

  8. 6.0CVE-2026-57192EPSS 0.7%

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow throug…

  9. 9.2CVE-2026-112710EPSS 0.4%

    A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potenti…

  10. 9.2CVE-2026-112709EPSS 0.4%

    A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially ex…

  11. 1.9CVE-2026-107590EPSS 0.1%

    An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an int…

  12. 6.9CVE-2026-116737EPSS 0.1%

    libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk i…

  13. 8.8CVE-2026-82944EPSS 0.2%

    SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative s…

  14. 9.5CVE-2026-97631EPSS 0.6%

    EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary c…

  15. 8.2CVE-2020-37287EPSS 0.3%

    Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or…

  16. 4.8CVE-2026-95111EPSS 0.1%

    A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queu…

  17. 6.9CVE-2026-112008EPSS 0.1%

    libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. At…

  18. 6.5CVE-2026-92156EPSS 0.5%

    F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManag…

  19. 7.8CVE-2026-86563EPSS 0.2%

    A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.

  20. 8.7CVE-2026-102027EPSS 0.5%

    An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the a…

  21. 6.5CVE-2026-106574EPSS 0.2%

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculatio…

  22. 6.3CVE-2026-104424EPSS 0.3%

    Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budget. Attackers can place valid selectable transactions in a victim min…

  23. 6.3CVE-2026-102505EPSS 0.2%

    Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every re…

  24. 7.8CVE-2026-47578EPSS 0.1%

    NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect buffer size calculation. A successful exploit of this vulnerability might lead to code execution, denial of …

  25. 5.9CVE-2026-102729EPSS 0.1%

    `gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes…

  26. 8.8CVE-2026-95509EPSS 0.3%

    Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.

  27. 7.5CVE-2026-88355EPSS 0.4%

    An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr(). For arity-0 expression nodes, including constants, variables, and zero-argument functions, the function allocates less memory than sizeof(t…

  28. 8.3CVE-2026-13466EPSS 0.1%

    Incorrect calculation of buffer size vulnerability in Altera Trusted Firmware on HPS allows Overflow Buffers. This issue affects Trusted Firmware: through socfpga_v2.14.0.

  29. 7.5CVE-2026-88830EPSS 0.4%

    A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

  30. 4.0CVE-2026-84448EPSS 0.2%

    libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals t…

  31. 7.6CVE-2026-67549EPSS 0.3%

    OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so calle…

  32. 7.8CVE-2026-54692EPSS 0.2%

    SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the…

  33. 5.3CVE-2026-91962EPSS 0.3%

    FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSG_SNDIN_OPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer siz…

  34. 7.2CVE-2026-47773EPSS 0.1%

    ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memor…

  35. 9.1CVE-2026-22590EPSS 0.5%

    eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while …

  36. 8.8CVE-2026-69598EPSS 0.8%

    Incorrect calculation of buffer size in Windows iSCSI allows an unauthorized attacker to execute code over a network.

  37. 5.9CVE-2026-78221EPSS 0.1%

    An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose sensitive information via crafted NRPT inputs.

  38. 2.5CVE-2026-18743EPSS 0.1%

    A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the `popt…

  39. 7.5CVE-2026-78002EPSS 1.1%

    A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer si…

  40. 7.5CVE-2026-16924EPSS 0.5%

    IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper calculation of a memory offset during IPsec decapsulation.

  41. 5.3CVE-2026-44254EPSS 0.5%

    Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage() in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG(), …

  42. 7.3CVE-2026-52834EPSS 0.2%

    jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::with_alloc_tracker and related grid and subgrid a…

  43. 2.1CVE-2026-75093EPSS 0.6%

    A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::from_raw_dt_align of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calcu…

  44. 8.3CVE-2026-70457EPSS 0.4%

    rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size st…

  45. 7.5CVE-2026-68287EPSS 0.7%

    In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix size calculations for 64-bit attributes net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use nla_put_u64_64bit() to append 64-bit attribu…

  46. 7.8CVE-2026-42170EPSS 0.2%

    A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an und…

  47. 7.8CVE-2026-42169EPSS 0.1%

    A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionall…

  48. 6.5CVE-2026-45812EPSS 0.7%

    Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next repo…

  49. 8.5CVE-2026-65706EPSS 0.2%

    FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame…

  50. 7.3CVE-2026-65705EPSS 0.2%

    FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization di…