Description
View on MITREExtended Description
When processing structured incoming data containing a size field followed by raw data, ensure that you identify and resolve any inconsistencies between the size field and the actual size of the data.
Do not let the user control the size of the buffer.
Validate that the length of the user-supplied data is consistent with the buffer size.
No detection method information available for this CWE.
No examples or observed CVEs available for this CWE.
CWE-130: CWE-130: Improper Handling of Length Parameter Inconsistency is a Common Weakness Enumeration (CWE) entry maintained by MITRE. Description Extended Description
If exploited, CWE-130 (CWE-130: Improper Handling of Length Parameter Inconsistency) it can compromise Read Memory, Modify Memory and Varies by Context, leading to outcomes such as Scope: Confidentiality and Integrity.
Recommended mitigations for CWE-130 include: When processing structured incoming data containing a size field followed by raw data, ensure that you identify and resolve any inconsistencies between the size field and the actual size of the data. Do not let the user control the size of the buffer. Validate that the length of the user-supplied data is consistent with the buffer size.
CWE-130 commonly affects Languages. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
A CWE (Common Weakness Enumeration) like CWE-130 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.