CWE-193: Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Consequences

• Availability: DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Instability
• Integrity: Modify Memory
• Confidentiality, Availability, Access Control: Execute Unauthorized Code or Commands, Bypass Protection Mechanism

How to prevent it

• Implementation: When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strncat(), printf(), sprintf(), scanf() and sscanf().

Recent advisories

• GHSA-q97c-p368-75c4 — vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
• GHSA-v859-c572-qh5p — ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions
• GHSA-hwf3-r46v-5ggx — ImageMagick: Information Disclosure when printing profiles with debug enabled
• GHSA-4565-r4x7-hg8j — Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation
• GHSA-jqq5-8px3-9m6m — ImageMagick: Heap Buffer Over-Write in json and yaml encoder of a single byte due to incorrect fix
• GHSA-533m-3wf6-c33v — ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder.
• GHSA-cr6r-hmj8-pr7r — ImageMagick: Out-of-Bounds Read of a single byte in meta encoder
• GHSA-q8h3-jv9v-57qx — ImageMagick has has an off-by-one origin validation in allows out-of-bounds read in morphology processing
• GHSA-5xg3-585r-9jh5 — ImageMagick has an off-by-one error in MSL decoder could result in crash
• GHSA-pxq6-2prw-chj9 — Moby has an Off-by-one error in its plugin privilege validation
• GHSA-gmq8-994r-jv83 — yauzl contains an off-by-one error
• GHSA-48wf-g7cp-gr3m — OpenClaw has allowlist exec-guard bypass via env -S
• GHSA-7355-pwx2-pm84 — ImageMagick: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder
• GHSA-hm4x-r5hc-794f — ImageMagick has a Heap Buffer Overflow in InterpretImageFilename
• GHSA-6m97-7527-mh74 — incorrect storage layout for contracts containing large arrays

All advisories for CWE-193