CWE-131: Incorrect Calculation of Buffer Size
The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
121 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2024-23622 — IBM Merge Healthcare eFilm Workstation License Server CopySLS_Request3 Buffer Overflow
- CVE-2024-23621 — IBM Merge Healthcare eFilm Workstation License Server Buffer Overflow
- CVE-2024-23606 — An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0
- CVE-2025-66216 — AIS-catcher has a Buffer Overflow vulnerability in `AIS::Message` leading to DoS/RCE
- CVE-2025-27074 — Incorrect Calculation of Buffer Size in SCE-Mink
- CVE-2026-20911 — A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and C
- CVE-2026-49841 — FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read
- CVE-2026-1949 — Incorrect calculation of buffer size on the stack in AS320T
- CVE-2025-46723 — OpenVM byte decomposition of pc in AUIPC chip can overflow
- CVE-2025-27053 — Incorrect Calculation of Buffer Size in HLOS
- CVE-2025-27042 — Incorrect Calculation of Buffer Size in Video
- CVE-2026-41197 — Brillig: Heap corruption in foreign call results with nested tuple arrays
- CVE-2026-20049 — A vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec t
- CVE-2026-22590 — Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG sampleSize / fragmentsInSubmessage
- CVE-2024-5000 — CODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA products
- CVE-2024-23805 — F5 Application Visibility and Reporting module and BIG-IP Advanced WAF/ASM vulnerability
- CVE-2026-40618 — BIG-IP SSL/TLS vulnerability
- CVE-2026-33987 — FreeRDP: Persistent Cache bmpSize Desync - Heap OOB Write
- CVE-2026-31970 — HTSlib BGZF index file reader has a heap buffer overflow
- CVE-2025-52955 — Junos OS and Junos OS Evolved: When jflow/sflow is configured continuous logical interface flaps causes rpd crash and restart
Recently published
- CVE-2026-22590 — Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG sampleSize / fragmentsInSubmessage
- CVE-2026-78221 — An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local
- CVE-2026-18743 — Popt-devel: popt-static: short realloc in poptconfigfiletostring
- CVE-2026-78002 — Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function
- CVE-2026-44254 — Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path
- CVE-2026-52834 — jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms
- CVE-2026-75093 — sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size
- CVE-2026-70457 — rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()
- CVE-2026-42170 — Gimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_layer() (ddsread.c)
- CVE-2026-42169 — Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)
- CVE-2026-45812 — Apache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report Handler
- CVE-2026-65706 — FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing
- CVE-2026-65705 — FFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame()
- CVE-2026-45784 — rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers
- CVE-2026-55827 — FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decode
- CVE-2026-0280 — PAN-OS: IPv6 Firewall Policy Bypass
- CVE-2026-54696 — Ruby JSON: JSON generator heap buffer overflow when streaming to an IO
- CVE-2026-11604 — An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allo
- CVE-2026-49841 — FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read
- CVE-2026-40618 — BIG-IP SSL/TLS vulnerability
More specific weaknesses
- CWE-467 — Use of sizeof() on a Pointer Type