Common Weakness Enumeration
CWE-193
AllowedOff-by-one Error
Abstraction: Base · Status: Draft
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
278 vulnerabilities reference this CWE, most recent first.
GHSA-7HCC-G6HM-H786
Vulnerability from github – Published: 2022-04-30 18:17 – Updated: 2024-02-02 03:30
VLAI
Details
Off-by-one vulnerability in CPIA driver of Linux kernel before 2.2.19 allows users to modify kernel memory.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2001-1391"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2001-04-17T04:00:00Z",
"severity": "LOW"
},
"details": "Off-by-one vulnerability in CPIA driver of Linux kernel before 2.2.19 allows users to modify kernel memory.",
"id": "GHSA-7hcc-g6hm-h786",
"modified": "2024-02-02T03:30:27Z",
"published": "2022-04-30T18:17:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2001-1391"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11162"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2001/dsa-047"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=98575345009963\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=98637996127004\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=98653252326445\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=98684172109474\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=98759029811377\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=98775114228203\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=99013830726309\u0026w=2"
},
{
"type": "WEB",
"url": "http://www.linux.org.uk/VERSION/relnotes.2219.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2001-047.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7HCX-RXP8-J55G
Vulnerability from github – Published: 2022-05-01 17:59 – Updated: 2025-04-09 03:40
VLAI
Details
Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.
{
"affected": [],
"aliases": [
"CVE-2007-2052"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-04-16T22:19:00Z",
"severity": "MODERATE"
},
"details": "Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.",
"id": "GHSA-7hcx-rxp8-j55g",
"modified": "2025-04-09T03:40:15Z",
"published": "2022-05-01T17:59:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-2052"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235093"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34060"
},
{
"type": "WEB",
"url": "https://issues.rpath.com/browse/RPL-1358"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11716"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8353"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=416934"
},
{
"type": "WEB",
"url": "http://lists.vmware.com/pipermail/security-announce/2008/000005.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/25190"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/25217"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/25233"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/25353"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/25787"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/28027"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/28050"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/29032"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/29303"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/29889"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31255"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31492"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/37471"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2008/dsa-1551"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2008/dsa-1620"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:099"
},
{
"type": "WEB",
"url": "http://www.novell.com/linux/security/advisories/2007_13_sr.html"
},
{
"type": "WEB",
"url": "http://www.python.org/download/releases/2.5.1/NEWS.txt"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2007-1076.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2007-1077.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2008-0629.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/469294/30/6450/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/488457/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/23887"
},
{
"type": "WEB",
"url": "http://www.trustix.org/errata/2007/0019"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/usn-585-1"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2007/1465"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/0637"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/3316"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7M35-VW2C-696V
Vulnerability from github – Published: 2025-04-21 03:30 – Updated: 2026-03-12 17:22
VLAI
Summary
GoBGP panics due to a zero value for softwareVersionLen
Details
An issue was discovered in GoBGP before 3.35.0 (introduced in v3.11.0). pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen.
Severity
8.6 (High)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/osrg/gobgp/v3"
},
"ranges": [
{
"events": [
{
"introduced": "3.11.0"
},
{
"fixed": "3.35.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-43971"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-21T21:55:26Z",
"nvd_published_at": "2025-04-21T01:15:45Z",
"severity": "HIGH"
},
"details": "An issue was discovered in GoBGP before 3.35.0 (introduced in v3.11.0). pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen.",
"id": "GHSA-7m35-vw2c-696v",
"modified": "2026-03-12T17:22:08Z",
"published": "2025-04-21T03:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43971"
},
{
"type": "WEB",
"url": "https://github.com/osrg/gobgp/commit/08a001e06d90e8bcc190084c66992f46f62c0986"
},
{
"type": "PACKAGE",
"url": "https://github.com/osrg/gobgp"
},
{
"type": "WEB",
"url": "https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2025-43971"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "GoBGP panics due to a zero value for softwareVersionLen"
}
GHSA-83P9-MCPM-374V
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-05-24 19:03
VLAI
Details
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
Severity
9.4 (Critical)
{
"affected": [],
"aliases": [
"CVE-2021-23017"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-01T13:15:00Z",
"severity": "CRITICAL"
},
"details": "A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.",
"id": "GHSA-83p9-mcpm-374v",
"modified": "2022-05-24T19:03:49Z",
"published": "2022-05-24T19:03:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23017"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r37e6b2165f7c910d8e15fd54f4697857619ad2625f56583802004009@%3Cnotifications.apisix.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r4d4966221ca399ce948ef34884652265729d7d9ef8179c78d7f17e7f@%3Cnotifications.apisix.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r6fc5c57b38e93e36213e9a18c8a4e5dbd5ced1c7e57f08a1735975ba@%3Cnotifications.apisix.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf232eecd47fdc44520192810560303073cefd684b321f85e311bad31@%3Cnotifications.apisix.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf318aeeb4d7a3a312734780b47de83cefb7e6995da0b2cae5c28675c@%3Cnotifications.apisix.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SFVYHC7OXTEO4SMBWXDVK6E5IMEYMEE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNKOP2JR5L7KCIZTJRZDCUPJTUONMC5I"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210708-0006"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K12331123,"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2022.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"type": "WEB",
"url": "http://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/167720/Nginx-1.20.0-Denial-Of-Service.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8499-WHQ2-XRRF
Vulnerability from github – Published: 2026-05-04 09:31 – Updated: 2026-05-04 09:31
VLAI
Details
mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-43860"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-04T07:16:00Z",
"severity": "LOW"
},
"details": "mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest.",
"id": "GHSA-8499-whq2-xrrf",
"modified": "2026-05-04T09:31:09Z",
"published": "2026-05-04T09:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43860"
},
{
"type": "WEB",
"url": "https://github.com/muttmua/mutt/commit/834c5a2ed0479e51e8662a31caed129f136f4805"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-84G5-X8J3-7235
Vulnerability from github – Published: 2026-04-29 22:22 – Updated: 2026-04-29 22:22
VLAI
Summary
Netfoil has incorrect allowlist enforcement
Details
Summary
Rules could be bypassed by changing the first character: example.com could be be bypassed by e.g. fxample.com.
Details
Off-by-one error in the suffixtrie implementation.
Impact
The domain filter could be bypassed. Please note that DNS filtering alone is not enough to block malicious traffic.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/tinfoil-factory/netfoil"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-183",
"CWE-193"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-29T22:22:16Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nRules could be bypassed by changing the first character: `example.com` could be be bypassed by e.g. `fxample.com`.\n\n### Details\nOff-by-one error in the suffixtrie implementation.\n\n### Impact\nThe domain filter could be bypassed. Please note that DNS filtering alone is not enough to block malicious traffic.",
"id": "GHSA-84g5-x8j3-7235",
"modified": "2026-04-29T22:22:16Z",
"published": "2026-04-29T22:22:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-84g5-x8j3-7235"
},
{
"type": "WEB",
"url": "https://github.com/tinfoil-factory/netfoil/commit/0ca054acf97b011e4fdd40392475c7786b975ec3"
},
{
"type": "PACKAGE",
"url": "https://github.com/tinfoil-factory/netfoil"
},
{
"type": "WEB",
"url": "https://github.com/tinfoil-factory/netfoil/releases/tag/v0.2.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Netfoil has incorrect allowlist enforcement"
}
GHSA-8745-Q6HH-2437
Vulnerability from github – Published: 2025-03-19 03:30 – Updated: 2025-03-19 03:30
VLAI
Details
Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code, potentially leading to a broader impact across the system via unspecified vectors.
Severity
10.0 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-10442"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-19T03:15:11Z",
"severity": "CRITICAL"
},
"details": "Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code, potentially leading to a broader impact across the system via unspecified vectors.",
"id": "GHSA-8745-q6hh-2437",
"modified": "2025-03-19T03:30:35Z",
"published": "2025-03-19T03:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10442"
},
{
"type": "WEB",
"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_22"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-899X-JHM8-PC3M
Vulnerability from github – Published: 2022-04-29 02:57 – Updated: 2024-02-02 03:30
VLAI
Details
Off-by-one buffer overflow in _xlate_ascii_write() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2004-0346"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-11-23T05:00:00Z",
"severity": "HIGH"
},
"details": "Off-by-one buffer overflow in _xlate_ascii_write() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.",
"id": "GHSA-899x-jhm8-pc3m",
"modified": "2024-02-02T03:30:30Z",
"published": "2022-04-29T02:57:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0346"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15387"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=107824679817240\u0026w=2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/9782"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8G6H-GJ49-CM84
Vulnerability from github – Published: 2022-05-02 03:22 – Updated: 2022-05-02 03:22
VLAI
Details
Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of service (stack corruption and application termination) via a crafted EMF file that triggers an integer overflow, as demonstrated by voltage-exploit.emf, aka the "Microsoft GdiPlus EMF GpFont.SetData integer overflow."
{
"affected": [],
"aliases": [
"CVE-2009-1217"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-04-01T18:00:00Z",
"severity": "MODERATE"
},
"details": "Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of service (stack corruption and application termination) via a crafted EMF file that triggers an integer overflow, as demonstrated by voltage-exploit.emf, aka the \"Microsoft GdiPlus EMF GpFont.SetData integer overflow.\"",
"id": "GHSA-8g6h-gj49-cm84",
"modified": "2022-05-02T03:22:45Z",
"published": "2022-05-02T03:22:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1217"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49438"
},
{
"type": "WEB",
"url": "http://bl4cksecurity.blogspot.com/2009/03/microsoft-gdiplus-emf-gpfontsetdata.html"
},
{
"type": "WEB",
"url": "http://blogs.technet.com/srd/archive/2009/03/26/new-emf-gdiplus-dll-crash-not-exploitable-for-code-execution.aspx"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/34250"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/0832"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8P7J-VHGR-RCW5
Vulnerability from github – Published: 2026-06-25 21:31 – Updated: 2026-06-25 21:31
VLAI
Details
RTKLIB through 2.4.3 contains an off-by-one out-of-bounds read vulnerability in the decode_ssr3 function at src/rtcm3.c:1446 that allows remote attackers to trigger a global buffer overflow via crafted RTCM3 SSR messages with attacker-controlled signal mode fields. Remote attackers can exploit this vulnerability by sending malicious SSR correction streams over NTRIP or serial connections to cause denial of service or crash RTKLIB rovers and CORS servers.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-56787"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-25T19:16:45Z",
"severity": "MODERATE"
},
"details": "RTKLIB through 2.4.3 contains an off-by-one out-of-bounds read vulnerability in the decode_ssr3 function at src/rtcm3.c:1446 that allows remote attackers to trigger a global buffer overflow via crafted RTCM3 SSR messages with attacker-controlled signal mode fields. Remote attackers can exploit this vulnerability by sending malicious SSR correction streams over NTRIP or serial connections to cause denial of service or crash RTKLIB rovers and CORS servers.",
"id": "GHSA-8p7j-vhgr-rcw5",
"modified": "2026-06-25T21:31:30Z",
"published": "2026-06-25T21:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56787"
},
{
"type": "WEB",
"url": "https://github.com/tomojitakasu/RTKLIB/issues/798"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/rtklib-off-by-one-out-of-bounds-read-in-decode-ssr3-via-rtcm3-ssr-message"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Implementation
When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strncat(), printf(), sprintf(), scanf() and sscanf().
No CAPEC attack patterns related to this CWE.