CWE-135: Incorrect Calculation of Multi-Byte String Length
The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.
Last updated
Overview
CWE-135 (Incorrect Calculation of Multi-Byte String Length) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.
Real-world CVEs
1 recorded CVEs are caused by CWE-135 (Incorrect Calculation of Multi-Byte String Length). The highest-severity and most recent are shown first. 1 new CWE-135 CVE has been recorded so far in 2026.
Common consequences
What can happen when CWE-135 is exploited.
Execute Unauthorized Code or Commands
Affects: Integrity, Confidentiality, Availability
This weakness may lead to a buffer overflow. Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. This can often be used to subvert any other security service.
Read Memory, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
Affects: Availability, Confidentiality
Out of bounds memory access will very likely result in the corruption of relevant memory, and perhaps instructions, possibly leading to a crash. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.