Weaknesses of type CWE-121

3,823 results

Estouro de buffer na pilha

Ocorre quando um programa escreve mais dados em um buffer alocado na pilha do que ele pode conter, sobrescrevendo dados adjacentes (variáveis, endereços de retorno, ponteiros). Um atacante pode explorar isso para executar código arbitrário ou causar travamento.

Example

Um programa lê uma string do usuário com gets() ou strcpy() sem validar o tamanho, copiando 500 bytes para um buffer de 64 bytes. O excesso sobrescreve o endereço de retorno da função, permitindo desviar a execução para código malicioso.

How to mitigate

Use funções seguras (strncpy, fgets, snprintf) que aceitam limite de bytes; implemente verificações de limites explícitas no código; ative proteções do compilador/SO (stack canaries, DEP/NX, ASLR); use linguagens com verificação automática de limites ou ferramentas de análise estática.

CVE-2024-4247HIGHTenda i21 formQosManage_auto stack-based overflowEPSS 1.5%CVE-2024-4497HIGHTenda i21 formexeCommand stack-based overflowEPSS 1.5%CVE-2024-4493HIGHTenda i21 formSetAutoPing stack-based overflowEPSS 1.5%CVE-2024-4237HIGHTenda AX1806 execCommand R7WebsSecurityHandler stack-based overflowEPSS 1.5%CVE-2024-4238HIGHTenda AX1806 SetOnlineDevName formSetDeviceName stack-based overflowEPSS 1.5%CVE-2024-4239HIGHTenda AX1806 SetRebootTimer formSetRebootTimer stack-based overflowEPSS 1.5%CVE-2024-26180HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 1.5%CVE-2024-3879HIGHTenda W30E setcfm formSetCfm stack-based overflowEPSS 1.5%CVE-2024-4240HIGHTenda W9 formQosManageDouble_user stack-based overflowEPSS 1.5%CVE-2021-27396—A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validEPSS 1.5%CVE-2021-27398—A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validEPSS 1.5%CVE-2024-3882HIGHTenda W30E fromRouteStatic stack-based overflowEPSS 1.4%CVE-2026-86296CRITICALD-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflowEPSS 1.4%CVE-2022-28772—By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.EPSS 1.4%CVE-2019-13518—An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the EZ Touch Editor VEPSS 1.4%CVE-2025-1853HIGHTenda AC8 Parameter SetIpMacBind sub_49E098 stack-based overflowEPSS 1.4%CVE-2022-27646HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.9EPSS 1.4%CVE-2019-13540—Delta Electronics TPEditor, Versions 1.94 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing speEPSS 1.4%CVE-2021-3057HIGHGlobalProtect App: Buffer Overflow Vulnerability When Connecting to Portal or GatewayEPSS 1.4%CVE-2026-76071CRITICALNetis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost ParameterEPSS 1.4%