Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A native (JNI) compress/uncompress entry point is invoked with an explicit byte offset/length into the source and an output region whose capacity was never validated before the call. The native layer reads and writes through raw pointers without bounds checks, so an input range outside the source buffer, or a destination smaller than the required compressed/
The container `$MOD` is indexed using the length/size of a different object `$ORIG`. If `$MOD` has a shorter length than `$ORIG` (for instance after trimming or transformation), this leads to an out-of-bounds memory read (buffer over-read).
Pointer arithmetic calculates an offset backwards from the end of a buffer ($IV + $LEN - $OFFSET) without verifying that $LEN >= $OFFSET, potentially leading to buffer underflow or out-of-bounds access.
A byte array is passed into a method or processed by a bounds check wrapper without sound bounds validation. Using `off + len - 1` can cause integer overflow, and skipping checks when `len == 0` can bypass offset boundaries. Attackers can trigger out-of-bounds reads/writes in native code relying on this, leading to information disclosure or JVM crashes. Use
TypedImageChannel::row() uses the origin-adjusted _base pointer instead of the backing buffer pointer, leading to out-of-bounds memory read/write for non-zero data window origins.
The in/out buffer size parameter `$LEN` passed to `gnutls_x509_crt_get_subject_alt_name` is not reset within the loop body. If `$LEN` retains a larger buffer size from earlier operations or is overwritten by GnuTLS, subsequent iterations may cause a buffer overflow or improper truncation.
Row or Y coordinate is calculated using horizontal/X-axis origin (min.x) instead of vertical/Y-axis origin (min.y), which can cause out-of-bounds indexing and heap corruption when min.x != min.y.
Missing validation for `nb_blocks` parameter in Argon2 configuration. `nb_blocks` must be at least `nb_lanes * 8` to prevent a potential heap buffer overflow in the underlying C implementation. Ensure `nb_blocks` or the assigned variable is validated using an `if` or `assert` statement.
Accumulating values into `num_passes` without prior bounds checking allows out-of-bounds array indexing on the `pass_length` array, causing a heap buffer overflow. Calculate increments securely into a temporary variable and validate against maximum bounds before mutating `num_passes`.
A native memory pointer is retrieved from a Netty ByteBuf by fallback to `internalNioBuffer(0, buffer.capacity())`. JNI's `GetDirectBufferAddress` returns the base address of the shared chunk. By passing the full capacity and ignoring the explicit slice offset (`ByteBuffer.position()`), out-of-bounds access happens on pooled buffers. Calculate memory address
Data is copied into an offset buffer and the offset is incremented without a bounds check ensuring that the offset plus copy length does not exceed the buffer capacity. This can lead to an out-of-bounds memory write.
Unchecked subtraction of `sizeof` from a length variable before a memory copy operation. This can lead to integer underflow if the length is smaller than the `sizeof` value, causing an out-of-bounds read/write when passed to `memcpy` or `memmove`. Always validate the length before subtraction.
Using out-of-line libcalls for WebAssembly passive data segment operations (like `memory.init`, `data.drop`, `array.new_data`) is vulnerable to out-of-bounds memory access. The libcalls lack inline unbypassable JIT bounds checking and may race with mutations or yields, leading to unchecked memory accesses. Natively generate checking logic by safely reading p
Integer overflow vulnerability in 2D rectangle bounds checks. When checking if a 2D rectangle is out of bounds, addition of variables (e.g., x + width) can overflow if 32-bit integers are used, wrapping around to a small value and bypassing the bounds check. This can lead to out-of-bounds memory accesses. Use 64-bit integer types (e.g. uint64_t) for bounds c
A reallocation condition checks two parameters but fails to verify a third parameter that is passed to the allocation function. If only the third parameter changes, the reallocation is incorrectly skipped and the object retains stale state. This can lead to out-of-bounds memory accesses.
Advancing a string or stream pointer via `Stream_Seek` without checking its bounds after an alignment calculation allows out-of-bounds skips. This could lead to a crash (e.g. `WINPR_ASSERT`) via unvalidated stream operations. Use `Stream_SafeSeek` instead, which securely enforces bounds limits.
Missing bounds check on WPS fragment length calculation can lead to integer underflow and memory corruption.
A cleanup function was called with an additive duplicate variable expression (`$X + $X`). This is heavily indicative of a typo for a loop index or single variable `$X` (e.g., `i + i` instead of `i`). Calling a cleanup function with an accidentally doubled size or index overestimates initialized bounds, leading to out-of-bounds memory accesses and corrupted m
Unchecked `split_at` or `split_at_mut` on slices can cause a panic if the index represents an out-of-bounds position. When processing untrusted parser inputs or ciphertexts, this missing bounds check triggers Rust unwinding and results in a Denial of Service (DoS). Consider using `split_at_checked` or `split_at_mut_checked` which return an `Option` for safe
An ELF RELA relocation entry offset `r_offset` is added to a memory address without checking if `r_offset` falls within the bounds of the target section (`sh_size`). An attacker supplying a crafted ELF file with a large `r_offset` can cause out-of-bounds memory writes during ELF linking.
TEE user-space copy routine performs memcpy without validating pointer bounds or access rights.
A value read from an untrusted buffer is used as a loop boundary for array indexing without being validated against a maximum limit. This missing bound check can lead to out-of-bounds read or write operations, potentially causing heap corruption or information disclosure vulnerabilities (CWE-502, CWE-119, CWE-787). Ensure that boundary limits parsed from unt
Hardcoded matrix stride dimensions passed to submatrix extraction may cause out-of-bounds memory read/write.
Validation of AVRCP vendor command length is insecure. The code either uses AVRC_MIN_CMD_LEN (20 bytes) which is too small for vendor messages (29 bytes), or it relies on assert() for validation which is compiled out in production (NDEBUG) builds. This can lead to heap-based out-of-bounds writes. Replace assert() with a runtime conditional and use a properly
