Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Data is copied from an internal buffer struct into a caller-provided buffer using the internal buffer's count without validating or bounding against the caller-supplied length parameter. This can result in a buffer overflow if the internal buffer contains more data than the destination buffer capacity.
Incorrect rewind offset `(j - 1)` instead of `j` in partial string match failure can lead to undersized buffer allocation and subsequent heap buffer overflow.
Missing buffer capacity validation when decoding byte array data or setting length can lead to out-of-bounds writes.
Unchecked response size copied into destination buffer in stream read implementation. Ensure the response length is validated to not exceed the requested buffer capacity (cb) before calling CopyMemory or memcpy.
Reusing sl_sal_first without zeroing or resetting it first can lead to miscalculated allocation sizes and heap buffer overflows when processing spell files.
Heap buffer allocation size calculated from string length and un-escaped character counts may under-count required bytes when parsing complex path strings, leading to a heap out-of-bounds write.
OpenEXR channel was processed and added without validating that xSampling and ySampling are equal to 1. Combining scanline EXR images with subsampled channels and misaligned data windows can lead to heap out-of-bounds memory corruption.
Manual PMR allocate call with multiplication by sizeof(...) can lead to integer overflow and heap buffer allocation of undersized memory. Prefer using RAII containers (such as std::vector with polymorphic_allocator) or validating bounds before allocating.
Scratch buffer size computed as a 64-bit integer is passed directly to internal_decode_alloc_buffer without checking for size_t integer truncation. On 32-bit systems (ILP32), this can result in an undersized buffer allocation and subsequent heap-based buffer overflow.
Accumulating buffer sizes in a loop using `+` or `+=` without overflow checks can lead to integer overflow. If the result is passed to an allocator, an undersized buffer is created, leading to a heap buffer overflow. Use sizes like `size_t` and safe integer arithmetic constructs like `INT_ADD_OK` to prevent overflow.
The output buffer remaining length (`outlen`) is incorrectly set to the total allocated size after an E2BIG error during `iconv` character conversion. Because the output pointer is also advanced by the already used bytes (`done`), this allows `iconv` to write past the end of the allocated heap buffer on the next iteration.
Heap buffer allocation for inherited security descriptor uses static or incomplete slack estimation without accounting for dynamic CREATOR_OWNER and CREATOR_GROUP ACE expansions, potentially causing a heap buffer overflow.
Potential out-of-bounds write: `strstr` is used to check for a substring without capturing its pointer, but `memmove` is performed using a fixed offset from the base pointer (`$MATCH + $OFFSET`). Ensure the substring pointer is captured and bounds-checked before computing destination offsets.
Directly using an unvalidated structure length (e.g., a UNICODE_STRING Length from a target process's PEB) as the size argument to memory read functions can result in a heap buffer overflow. Attackers can inflate PEB string lengths (e.g., CommandLine.Length) up to USHORT_MAX (65535 bytes). Bounds should always be explicitly clamped or checked against the des
Missing validation for `nb_blocks` parameter in Argon2 configuration. `nb_blocks` must be at least `nb_lanes * 8` to prevent a potential heap buffer overflow in the underlying C implementation. Ensure `nb_blocks` or the assigned variable is validated using an `if` or `assert` statement.
Accumulating values into `num_passes` without prior bounds checking allows out-of-bounds array indexing on the `pass_length` array, causing a heap buffer overflow. Calculate increments securely into a temporary variable and validate against maximum bounds before mutating `num_passes`.
Row count computed from zlib decompression buffer capacity is used in a row processing function without bounds checking against remaining expected rows, risking an out-of-bounds write.
An improper bounds check was found where a required capacity upper limit is incorrectly increased by one (`> size + 1`). This off-by-one limit validation allows exactly one byte to be written or read out of bounds. Ensure limits bounds rely strictly on exact sizes, checking `offset + length > size`.
`readt()` reads `$RQST->namelen` bytes (attacker-controlled length from the CNID wire-format request header) into the fixed-size `$RQST->name` buffer without first validating `$RQST->namelen <= MAXPATHLEN`. This is the heap-based buffer overflow pattern fixed in CVE-2026-44050. Add a guard `if ($RQST->namelen > MAXPATHLEN) { ...; return 0; }` before this rea
A 64-bit integer from sqlite3_value_int64() is passed to sqlite3_malloc(), which only accepts a 32-bit int. Integer truncation can result in an undersized buffer allocation leading to heap buffer overflow. Use sqlite3_malloc64() instead.
Potential heap-based buffer overflow: buffer is allocated with QUERYMAXLEN instead of ENC_QUERYSTR while downstream string construction may write up to ENC_QUERYSTR bytes.
A string is decoded into a dynamically allocated buffer that is restricted to the exact size of the input string length, but a null byte is unconditionally written at the end. This leads to an off-by-one heap buffer overflow if the input does not shrink during decoding. Ensure that the buffer allocation explicitly reserves space for the null terminator (e.g.
VS-mode (cpu.v == 1) access to the supervisor interrupt CSRs sie/sip is being dispatched through vmode_get_sie / vmode_set_sie / vmode_get_sip / vmode_set_sip. These helpers do not apply the RISC-V H-extension delegation masking (get_hideleg() & (mideleg | MIDELEG_FORCED_MASK), hvien) and write directly to machine-level mie / hvip, which violates the privile
An incorrect buffer size calculation for formatting a list of IPv6 addresses leaves no space for a null terminator, leading to a heap buffer overflow. Removing the `- 1` subtraction and explicitly adding space for string termination prevents this corruption.
