Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Fixed-size stack buffer is populated using strncpy with an unvalidated caller-controlled length parameter, which can lead to a stack buffer overflow.
Data is copied from an internal buffer struct into a caller-provided buffer using the internal buffer's count without validating or bounding against the caller-supplied length parameter. This can result in a buffer overflow if the internal buffer contains more data than the destination buffer capacity.
Missing buffer capacity validation when decoding byte array data or setting length can lead to out-of-bounds writes.
Unchecked response size copied into destination buffer in stream read implementation. Ensure the response length is validated to not exceed the requested buffer capacity (cb) before calling CopyMemory or memcpy.
A fixed-size error buffer smaller than XML_ERROR_SIZE (1024 bytes) is passed to lilxml's readXMLFile, leading to a stack buffer overflow when formatting XML error messages.
Direct call to SOPC_ToolkitServer_SetAddressSpaceConfig bypasses address space validation and event initialization helper.
Uncompressed image encoder processes planar components without validating component plane dimensions against primary image dimensions, which can lead to heap buffer overflow.
AES-GCM and other block ciphers require a unique Initialization Vector (IV) for every encryption operation. Using a cached `AlgorithmParameterSpec` (e.g., from an instance or class field) results in IV reuse across multiple encryptions. For GCM mode, nonce reuse destroys confidentiality and allows an attacker to recover plaintexts. Generate a fresh IV using
A base64-encoded NTLM Type-3 response encapsulating untrusted server challenge data is formatted into a buffer via `sprintf` without prior length validation. An attacker controlling the NTLM Type-2 domain can cause this write to overflow a fixed-size stack buffer, resulting in remote code execution.
Potential out-of-bounds write: `strstr` is used to check for a substring without capturing its pointer, but `memmove` is performed using a fixed offset from the base pointer (`$MATCH + $OFFSET`). Ensure the substring pointer is captured and bounds-checked before computing destination offsets.
A dynamic length check correctly identifies that the remaining buffer is smaller than the required size, but triggers a flush/reallocation method without passing the required size. If the reallocation uses a predefined fixed size chunk, memory overrun can occur when formatting the string. Ensure that the computed required size is propagated.
A static array is cast to a struct and passed to a cryptographic function. This can lead to a stack buffer overflow if the encryption configuration, payload, or key size exceeds the statically allocated bounds. Ensure dynamic payloads are accommodated by allocating buffers organically using actual operational size limits, or strictly enforcing buffer bounds
A stack-based buffer overflow can occur when copying a string into a locally allocated, fixed-size array using `strcpy` without prior bounds-checking. Use `memcpy` with length validation instead.
Unbounded memcpy of an ASN.1 SpcIndirectDataContent digest into a buffer. This copies data trusting the `messageDigest->digest->length` field, which is controlled by the attacker. If the destination array has a fixed boundary (like EVP_MAX_MD_SIZE), this will cause a buffer overflow. Verify the length fits the destination buffer before moving memory.
A length extracted directly from a data buffer via pointer dereference is passed to memcpy without bounds checking against the maximum destination buffer size, leading to potential buffer overflow.
Missing validation of `output_components` after determining image dimensions. When calculating output buffer dimension allocations downstream of `jpeg_calc_output_dimensions`, the actual decoded `$CINFO->output_components` must be validated against expected bytes per pixel or buffer channels. Missing this validation allows malicious files with mismatched con
A buffer is parsed iteratively using sequential `memcpy` operations and pointer increments without any preceding bounds check. A malicious input controlling the loop condition or structural data lengths could induce an out-of-bounds read, risking data disclosure or denial of service crashes. Validate the pointer against the buffer end limit before attempting
Incorrect size calculation for strncat/g_strncat. Subtracting the length of the source string from the total size rather than the length of the destination buffer fails to account for data already accumulated in the destination. This can lead to a heap-based buffer overflow. Calculate the remaining size using the destination string length (e.g., size - 1 - s
A codec decodes an item length but fails to validate it against the allocated output buffer size before decoding the items into memory. This can lead to a heap or stack buffer overflow when an attacker supplies a byte array length larger than the buffer bounds.
The DTLS cookie-generate callback wrapper copies the callback-returned cookie bytes into the fixed-size OpenSSL `out` buffer via `out[0:len(cookie)] = cookie` without first bounding the cookie length against DTLS1_COOKIE_LENGTH (255). A callback returning more than 255 bytes overflows the OpenSSL-provided buffer (CVE-2026-27459, CWE-120). Add `if len(cookie)
StringUtils_copyStringToBuffer performs an unbounded string copy into the destination buffer without checking buffer boundaries, which can cause a buffer overflow or out-of-bounds read. Use StringUtils_copyStringMax instead.
Advancing a pointer or offset directly by the return value of 'strlcpy' can cause buffer overflows or integer underflows. 'strlcpy' returns the full length of the source string rather than the number of bytes written. If the source string exceeds the destination buffer size, the pointer will advance past the allocated boundary.
Unbounded string copy (`strcpy` or `strcat`) of parsed JSON data into a destination buffer can cause a buffer overflow if the parsed string exceeds the destination buffer size. Use bounded copying functions such as `strncpy` with explicit NUL termination or `strlcpy`.
USB control request handler copies fixed-size structure data into a net_buf using net_buf_add_mem with sizeof(...) without bounding by setup->wLength. If the host supplies a smaller wLength, this causes an out-of-bounds write. Bound the copied length using MIN(sizeof(...), setup->wLength).
