Weaknesses of type CWE-121

3,824 results

Estouro de buffer na pilha

Ocorre quando um programa escreve mais dados em um buffer alocado na pilha do que ele pode conter, sobrescrevendo dados adjacentes (variáveis, endereços de retorno, ponteiros). Um atacante pode explorar isso para executar código arbitrário ou causar travamento.

Example

Um programa lê uma string do usuário com gets() ou strcpy() sem validar o tamanho, copiando 500 bytes para um buffer de 64 bytes. O excesso sobrescreve o endereço de retorno da função, permitindo desviar a execução para código malicioso.

How to mitigate

Use funções seguras (strncpy, fgets, snprintf) que aceitam limite de bytes; implemente verificações de limites explícitas no código; ative proteções do compilador/SO (stack canaries, DEP/NX, ASLR); use linguagens com verificação automática de limites ou ferramentas de análise estática.

CVE-2024-31470CRITICALThere is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that could lead to unauthentiEPSS 1.2%CVE-2024-2547HIGHTenda AC18 R7WebsSecurityHandler stack-based overflowEPSS 1.2%CVE-2025-63658HIGHA stack overflow in the mk_http_index_lookup function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to cause a Denial of SEPSS 1.2%CVE-2025-15194CRITICALD-Link DIR-600 HTTP Header hedwig.cgi stack-based overflowEPSS 1.2%CVE-2022-21228HIGHICSA-22-090-03 Fuji Electric Alpha5EPSS 1.2%CVE-2025-40601HIGHA Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of ServicEPSS 1.2%CVE-2025-6158HIGHD-Link DIR-665 HTTP POST Request sub_AC78 stack-based overflowEPSS 1.2%CVE-2021-30496MEDIUMThe Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an atEPSS 1.2%CVE-2025-15047CRITICALTenda WH450 HTTP Request PPTPDClient stack-based overflowEPSS 1.2%CVE-2023-54329CRITICALInbit Messenger 4.9.0 - Unauthenticated Remote Command Execution (RCE)EPSS 1.2%CVE-2026-50527HIGH.NET Framework Denial of Service VulnerabilityEPSS 1.2%CVE-2026-50304HIGHWindows Active Directory Federation Services Denial of Service VulnerabilityEPSS 1.2%CVE-2026-50411HIGHWindows Active Directory Federation Services Denial of Service VulnerabilityEPSS 1.2%CVE-2026-54983HIGHWindows Active Directory Federation Services Denial of Service VulnerabilityEPSS 1.2%CVE-2026-50695HIGHWindows Active Directory Federation Services Denial of Service VulnerabilityEPSS 1.2%CVE-2026-50368HIGHWindows Active Directory Federation Services Denial of Service VulnerabilityEPSS 1.2%CVE-2026-50355HIGHWindows Active Directory Federation Services Denial of Service VulnerabilityEPSS 1.2%CVE-2025-6328HIGHD-Link DIR-815 hedwig.cgi sub_403794 stack-based overflowEPSS 1.2%CVE-2026-4555HIGHD-Link DIR-513 boa formEasySetTimezone memory corruptionEPSS 1.2%CVE-2026-5024HIGHD-Link DIR-513 formSetEmail stack-based overflowEPSS 1.2%