CWE-193: Off-by-one Error
Filter
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
What the weakness is: CWE-193 at MITRE. All weaknesses
Ask an AI about CWE-193
Show the prompt
Explain CWE-193: Off-by-one Error and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/193.html and https://cve.bz/cve/cwe/193?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.3CVE-2026-88708EPSS 0.2%
An off-by-one error in certain ASUS Router firmware allows an unauthenticated nearby user to send a packet with a specific header length, potentially overwriting memory and causing the affected service to crash. Refer to the ' Security Upd…
- 7.3CVE-2026-125257EPSS 0.1%
FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in get_exponent_dynamic() in libavcodec/nellymoserenc.c that allows writing one element past the opt and path allocations. Attackers can supply crafted audio to applic…
- 5.1CVE-2026-123370EPSS 0.3%
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028…
- 5.3CVE-2026-116781EPSS 0.3%
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, ws_read_frame() unmasked a WebSocket pa…
- 5.9CVE-2026-116574EPSS 0.4%
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_xml_ampencode() reserved only te…
- 7.5CVE-2026-120061EPSS 0.3%
The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overf…
- 6.9CVE-2026-116735EPSS 0.1%
libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB…
- 6.5CVE-2026-115916EPSS 0.3%
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validat…
- 5.3CVE-2026-114460EPSS 0.3%
A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request uncha…
- 4.3CVE-2026-12727EPSS 0.2%
IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names.
- 6.9CVE-2026-111273EPSS 0.2%
unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to writ…
- 8.8CVE-2026-108443EPSS 0.6%
Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- 6.5CVE-2026-101302EPSS 0.2%
TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid …
- 2.0CVE-2026-110604EPSS 0.2%
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-by…
- 8.8CVE-2026-97741EPSS 0.9%
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- 8.8CVE-2026-102857EPSS 0.9%
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
- 5.8CVE-2026-104774EPSS 0.3%
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing …
- 7.1CVE-2026-42618EPSS 0.1%
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is tri…
- 5.3CVE-2026-83742EPSS 0.4%
Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by s…
- 3.3CVE-2026-106584EPSS 0.06%
In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.
- 5.4CVE-2026-104033EPSS 0.2%
A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid credenti…
- 5.3CVE-2026-102720EPSS 0.2%
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the DHCP client's option walk advances its offset one byte less than its read pointer for every option it skips. A DHCP server, or any host on the link that answers first, can…
- 5.5CVE-2026-101014EPSS 0.3%
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performi…
- 5.5CVE-2026-100889EPSS 0.3%
A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from rem…
- 6.9CVE-2026-18460EPSS 0.4%
Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6.
- 6.5CVE-2026-83600EPSS 0.5%
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot in src/plugins.d/pluginsd_internals.h. The …
- 5.5CVE-2026-93018EPSS 0.2%
Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p. The palette is allocated uninitialised, and only the entries a reader adds …
- 5.5CVE-2026-76081EPSS 0.4%
ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue spe…
- 4.8CVE-2026-90781EPSS 0.2%
alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long contro…
- 7.8CVE-2026-81396EPSS 0.5%
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- 5.5CVE-2026-69609EPSS 0.4%
Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally.
- 8.2CVE-2026-86297EPSS 1.1%
A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument …
- 2.3CVE-2026-81738EPSS 0.3%
OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries
- 6.9CVE-2026-57160EPSS 0.4%
PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the function that serializes generic array…
- 5.5CVE-2026-17469EPSS 0.3%
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to an off-by-one write in the LPD queue name parser.
- 5.2CVE-2026-85454EPSS 0.3%
MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram() that writes a NUL terminator one byte past the serial telegram stack buffer. Attackers controlling the serial line can send a full-len…
- 5.4CVE-2026-14368EPSS 0.3%
The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if (string_length > buflen), which accepts a str…
- 7.5CVE-2026-46369EPSS 0.5%
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to …
- 7.5CVE-2026-65927EPSS 0.7%
Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 throug…
- 9.1CVE-2026-79148EPSS 0.3%
Off-by-one error in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially read memory inside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)
- 6.9CVE-2026-68767EPSS 0.2%
hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potf…
- 7.0CVE-2026-63387EPSS 0.4%
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated…
- 7.1CVE-2026-55564EPSS 0.3%
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malicio…
- 5.5CVE-2026-66806EPSS 0.4%
Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
- 5.3CVE-2026-71391EPSS 0.5%
GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison instead …
- 7.0CVE-2026-11771EPSS 0.4%
OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server
- 7.5CVE-2026-14899EPSS 0.5%
The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentia…
- 3.7CVE-2026-44687EPSS 0.2%
In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. T…
- 9.8CVE-2026-64047EPSS 0.5%
In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring When an sk_msg scatterlist ring wraps (sg.end < sg.start), tls_push_record() chains the tail por…
- 7.5CVE-2026-50497EPSS 0.9%
Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.