diff --git a/src/flash/nor/kinetis.c b/src/flash/nor/kinetis.c
index 455e7b1b0..5c0ffbd6f 100644
--- a/src/flash/nor/kinetis.c
+++ b/src/flash/nor/kinetis.c
@@ -1959,7 +1959,7 @@ static int kinetis_probe_chip(struct kinetis_chip *k_chip)
 	unsigned cpu_mhz = 120;
 	unsigned idx;
 	bool use_nvm_marking = false;
-	char flash_marking[8], nvm_marking[2];
+	char flash_marking[11], nvm_marking[2];
 	char name[40];
 
 	k_chip->probed = false;
diff --git a/src/flash/nor/xmc4xxx.c b/src/flash/nor/xmc4xxx.c
index 02df46a3f..5677ef0f1 100644
--- a/src/flash/nor/xmc4xxx.c
+++ b/src/flash/nor/xmc4xxx.c
@@ -931,13 +931,13 @@ static int xmc4xxx_get_info_command(struct flash_bank *bank, char *buf, int buf_
 
 	/* If OTP Write protection is enabled (User 2), list each
 	 * sector that has it enabled */
-	char otp_str[8];
+	char otp_str[14];
 	if (otp_enabled) {
 		strcat(prot_str, "\nOTP Protection is enabled for sectors:\n");
 		for (int i = 0; i < bank->num_sectors; i++) {
 			if (fb->write_prot_otp[i]) {
 				snprintf(otp_str, sizeof(otp_str), "- %d\n", i);
-				strncat(prot_str, otp_str, ARRAY_SIZE(otp_str));
+				strncat(prot_str, otp_str, sizeof(prot_str) - strlen(prot_str) - 1);
 			}
 		}
 	}
diff --git a/src/target/arm_adi_v5.c b/src/target/arm_adi_v5.c
index 88491196d..200629023 100644
--- a/src/target/arm_adi_v5.c
+++ b/src/target/arm_adi_v5.c
@@ -1059,7 +1059,7 @@ static int dap_rom_display(struct command_context *cmd_ctx,
 	int retval;
 	uint64_t pid;
 	uint32_t cid;
-	char tabs[7] = "";
+	char tabs[16] = "";
 
 	if (depth > 16) {
 		command_print(cmd_ctx, "\tTables too deep");
diff --git a/src/target/nds32_cmd.c b/src/target/nds32_cmd.c
index edb4872e4..500651dbc 100644
--- a/src/target/nds32_cmd.c
+++ b/src/target/nds32_cmd.c
@@ -816,7 +816,7 @@ static int jim_nds32_bulk_read(Jim_Interp *interp, int argc, Jim_Obj * const *ar
 	uint32_t *data = malloc(count * sizeof(uint32_t));
 	int result;
 	result = target_read_buffer(target, address, count * 4, (uint8_t *)data);
-	char data_str[11];
+	char data_str[12];
 
 	jim_wide i;
 	Jim_SetResult(interp, Jim_NewEmptyStringObj(interp));