Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Fixed-size stack buffer is populated using strncpy with an unvalidated caller-controlled length parameter, which can lead to a stack buffer overflow.
A fixed-size error buffer smaller than XML_ERROR_SIZE (1024 bytes) is passed to lilxml's readXMLFile, leading to a stack buffer overflow when formatting XML error messages.
Missing stack bounds checking (`CHECK_STACK_OVERFLOW`) in recursive ProxyObject prototype methods. This allows attackers to exhaust the C++ stack via deeply chained proxy objects, leading to an out-of-bounds stack operation.
A base64-encoded NTLM Type-3 response encapsulating untrusted server challenge data is formatted into a buffer via `sprintf` without prior length validation. An attacker controlling the NTLM Type-2 domain can cause this write to overflow a fixed-size stack buffer, resulting in remote code execution.
A 16-byte buffer is allocated for a DHCPv6 prefix exclude option (RFC 6603) that can occupy up to 17 bytes. This enables a one-byte stack buffer overflow.
A 16-byte fixed-size stack buffer is used to process an RFC6603 OPTION_PD_EXCLUDE payload. This leads to a 1-octet out-of-bounds write, as the option body can be up to 17 octets long. Ensure the buffer is dimensioned to at least 17 bytes.
Pointer or depth index `$DOC->$WHERE` is incremented prior to invoking `rb_yield` without state restoration (`$DOC->$WHERE--`) or depth bounds checking. When invoked recursively inside callback blocks, this can cause state pointer corruption and stack buffer overflow.
A stack-based buffer overflow can occur when recursively splitting cubic Bezier curves without enforcing a depth limit. The pointer tracking the current curve on the stack is advanced blindly, leading to out-of-bounds writes on the fixed-size bezier stack. Ensure stack bounds are checked before splitting.
Remaining buffer capacity is calculated using `strlen(...)` instead of `sizeof(...)` or the buffer capacity. When the string length in the buffer equals the subtracted length, this subtraction underflows unsigned integers, bypassing subsequent bounds checks and causing buffer overflows.
Remaining buffer capacity is calculated using strlen() instead of sizeof(), which can cause an unsigned integer underflow when subtracting string lengths, leading to buffer overflow vulnerabilities.
A directory entry name (`d_name`) is copied or concatenated into a fixed-size stack buffer using unsafe string functions (`strcpy`, `strcat`, `sprintf`). This can cause a stack-based buffer overflow if an attacker provides a long file or directory name. Use safely bounded string APIs such as `snprintf`.
A static array is cast to a struct and passed to a cryptographic function. This can lead to a stack buffer overflow if the encryption configuration, payload, or key size exceeds the statically allocated bounds. Ensure dynamic payloads are accommodated by allocating buffers organically using actual operational size limits, or strictly enforcing buffer bounds
Call to `ffi::EVP_DigestFinal` (or the raw `EVP_DigestFinal` C symbol) is not preceded by a bounds check that ensures the output buffer length is at least `EVP_MD_CTX_size(ctx)` bytes. `EVP_DigestFinal` always writes exactly the configured digest size into the `out` buffer, ignoring its `len` argument as a capacity bound, so passing an undersized buffer caus
A stack-based buffer overflow can occur when copying a string into a locally allocated, fixed-size array using `strcpy` without prior bounds-checking. Use `memcpy` with length validation instead.
Legacy 2-argument canformat::Serve() invocation on the externally reachable canlog TCP server attack surface, or unbounded use of the attacker-controlled `build_can_frame.length` field inside the GVRET binary parser. In the BUILD_CAN_FRAME path, the 1-byte length is used directly as a memcpy/Pop size into the fixed 8-byte CAN_frame_t::data and the ~16-byte s
Calls to `GetAnsiSize` calculate string length based on wide-character counts rather than actual UTF-8 byte counts. This causes buffer under-allocations and out-of-bounds writes (such as stack buffer overflows) on non-Windows platforms. Use `GetUtf8Size` instead, which properly accounts for multi-byte lengths and null terminators.
Unbounded string copy (`strcpy` or `strcat`) of parsed JSON data into a destination buffer can cause a buffer overflow if the parsed string exceeds the destination buffer size. Use bounded copying functions such as `strncpy` with explicit NUL termination or `strlcpy`.
A stack buffer sized for MD5 or SHA-256 hex checksums (65 bytes) is written using an unbounded string operation. If the application encounters larger hashes like SHA-384 or SHA-512 (which require up to 129 bytes for their hex representation), a stack-based buffer overflow can occur. Increase the buffer size (e.g. to 64 * 2 + 1) and use bounds-checking string
Call to snmp_asn1_dec_raw passes the same expression as both the read-length (2nd argument) and the destination buffer maximum length (5th argument). snmp_asn1_dec_raw's internal bounds check is `if (len > buf_max_len) return ERR_MEM;` so identical arguments make the guard a no-op, allowing an attacker-controlled ASN.1 OCTET STRING length (e.g. msgAuthentica
Bundled libxml2 version prior to 2.13.6 is vulnerable to DTD stack buffer overflow and XML Schema use-after-free.
memcpy() copies into a fixed-size local char buffer using a length taken from a struct field, without first checking that the length is less than sizeof(destination). If the struct field is attacker-controlled (e.g. a hostname, URI, or other length-prefixed input), this is a stack-based buffer overflow (CWE-121 / CWE-787). This is the exact root-cause patter
Incorrect remaining buffer size calculation using 'sizeof(buf) - (buf - ptr)'. Pointer arithmetic 'buf - ptr' results in a negative value when 'ptr' is advanced past 'buf', leading to a larger buffer length calculation than the actual remaining capacity. This causes integer underflow and can lead to a stack-based buffer overflow. The correct calculation is '
A buffer pointer is advanced using the return value of `sprintf` or directly appended without bounds checking. This can lead to a stack or heap buffer overflow. Ensure that the remaining buffer limit is explicitly checked before appending.
A structure length field is used in a write() operation alongside its expected data buffer without checking if the length is bounded by the buffer's true size. Doing so allows an attacker to control the struct fields and write out-of-bounds stack memory, causing a buffer overflow (CWE-120/CWE-121). Verify that the length field is checked against the maximum
