Weaknesses of type CWE-121

3,839 results

Estouro de buffer na pilha

Ocorre quando um programa escreve mais dados em um buffer alocado na pilha do que ele pode conter, sobrescrevendo dados adjacentes (variáveis, endereços de retorno, ponteiros). Um atacante pode explorar isso para executar código arbitrário ou causar travamento.

Example

Um programa lê uma string do usuário com gets() ou strcpy() sem validar o tamanho, copiando 500 bytes para um buffer de 64 bytes. O excesso sobrescreve o endereço de retorno da função, permitindo desviar a execução para código malicioso.

How to mitigate

Use funções seguras (strncpy, fgets, snprintf) que aceitam limite de bytes; implemente verificações de limites explícitas no código; ative proteções do compilador/SO (stack canaries, DEP/NX, ASLR); use linguagens com verificação automática de limites ou ferramentas de análise estática.

CVE-2025-57085CRITICALTenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function. This vulnerability EPSS 0.5%CVE-2025-25741MEDIUMD-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the IPv6_PppoePassword parameter in thEPSS 0.5%CVE-2023-42069HIGHPDF-XChange Editor PDF File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.5%CVE-2024-32288MEDIUMTenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page parameter in the fromwebExcptypemanFilter fuEPSS 0.5%CVE-2026-86514MEDIUMvgmstream txth-txtp txth.c sscanf stack-based overflowEPSS 0.5%CVE-2014-0774—Schneider Electric OFS Stack Buffer OverflowEPSS 0.5%CVE-2024-46546HIGHNEXTU FLETA AX1500 WIFI6 Router v1.0.3 was discovered to contain a stack overflow via the url parameter at /boafrm/formFilter. This vulnerabEPSS 0.5%CVE-2026-81396HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-11528HIGHTenda AC18 Web Management getRebootStatus sub_45304 stack-based overflowEPSS 0.5%CVE-2025-67187CRITICALA stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The flaw exists in the setIpQosRules EPSS 0.5%CVE-2026-63526HIGHMicrosoft Office Graphics Component Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-81953HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-11523HIGHTenda W20E Web Management PortalAuth formPortalAuth stack-based overflowEPSS 0.5%CVE-2026-64907HIGHMicrosoft Office Word Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-55141HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-11504HIGHTenda CX12L Wi-Fi Schedule Configuration Endpoint openSchedWifi setSchedWifi stack-based overflowEPSS 0.5%CVE-2026-66807HIGHMicrosoft Office Graphics Component Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-64919HIGHMicrosoft Access Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-11522HIGHTenda W20E setPortMirror formSetPortMirror stack-based overflowEPSS 0.5%CVE-2026-68817HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%