Skip to content
OpenAdvisories

Weakness (CWE)

CWE-131: Incorrect Calculation of Buffer Size

Base Draft

The product does not correctly calculate the size to be used when allocating a buffer.

How to prevent it (8 mitigations)

  1. Implementation

    When allocating a buffer for the purpose of transforming, converting, or encoding an input, allocate enough memory to handle the largest possible encoding. For example, in a routine that converts "&" characters to "&" for HTML entity encoding, the output buffer needs to be at least 5 times as large as the input buffer.

  2. Implementation

    Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]

    Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.

  3. Implementation

    Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.

  4. Architecture and Design

    For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

  5. Implementation

    When processing structured incoming data containing a size field followed by raw data, identify and resolve any inconsistencies between the size field and the actual size of the data (CWE-130).

  6. Implementation

    When allocating memory that uses sentinels to mark the end of a data structure - such as NUL bytes in strings - make sure you also include the sentinel in your calculation of the total amount of memory that must be allocated.

  7. Implementation

    Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.

  8. Implementation

    Use sizeof() on the appropriate data type to avoid CWE-467.

Source: MITRE CWE-131

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.5
    CVE-2026-97631 Public exploit

    Pre-boot RCE in EDK II PXE driver

    EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It co…

    TianoCore EDK2 edk2 edk2-hwe Debian Ubuntu
  • High 8.1
    CVE-2026-42055 Public exploit

    NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_hea…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Alpine
  • Critical 9.8
    CVE-2026-43501 Public exploit

    ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

    In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-42945 Public exploit EPSS 68%

    NGINX ngx_http_rewrite_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2022-31630 Public exploit

    OOB read due to insufficient input validation in imageloadfont()

    In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer wi…

    PHP Group PHP php7 php7.4 Debian Ubuntu Alpine
  • High 7.8
    CVE-2020-17087 Exploited Public exploit

    Windows Kernel Local Elevation of Privilege Vulnerability

    Windows Kernel Local Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2005-2103 Public exploit EPSS 16%

    Buffer overflow in the AIM and ICQ module in Gaim before 1.5.0 allows remote attackers to cause a denial of service (ap…