Weaknesses of type CWE-121

4,132 results

Estouro de buffer na pilha

Ocorre quando um programa escreve mais dados em um buffer alocado na pilha do que ele pode conter, sobrescrevendo dados adjacentes (variáveis, endereços de retorno, ponteiros). Um atacante pode explorar isso para executar código arbitrário ou causar travamento.

Example

Um programa lê uma string do usuário com gets() ou strcpy() sem validar o tamanho, copiando 500 bytes para um buffer de 64 bytes. O excesso sobrescreve o endereço de retorno da função, permitindo desviar a execução para código malicioso.

How to mitigate

Use funções seguras (strncpy, fgets, snprintf) que aceitam limite de bytes; implemente verificações de limites explícitas no código; ative proteções do compilador/SO (stack canaries, DEP/NX, ASLR); use linguagens com verificação automática de limites ou ferramentas de análise estática.

CVE-2019-3930—The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1EPSS 7.0%CVE-2025-11418CRITICALTenda CH22 HTTP Request AdvSetWrlsafeset formWrlsafeset stack-based overflowEPSS 6.9%CVE-2020-17407CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Microhard Bullet-LTE prior to v1.2.0-r1112EPSS 6.8%CVE-2021-36005HIGHAdobe Photoshop PSD File Parsing Stack Overflow VulnerabilityEPSS 6.8%CVE-2023-46223CRITICALAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofEPSS 6.8%CVE-2025-7093HIGHBelkin F9K1122 webs formSetLanguage stack-based overflowEPSS 6.8%CVE-2025-7089HIGHBelkin F9K1122 webs formWanTcpipSetup stack-based overflowEPSS 6.8%CVE-2025-7092HIGHBelkin F9K1122 webs formWlanSetupWPS stack-based overflowEPSS 6.8%CVE-2025-7090HIGHBelkin F9K1122 webs formConnectionSetting stack-based overflowEPSS 6.8%CVE-2018-8847—Eaton 9000X DriveA versions 2.0.29 and prior has a stack-based buffer overflow vulnerability, which may allow remote code execution.EPSS 6.8%CVE-2025-7762HIGHD-Link DI-8100 HTTP Request menu_nat_more.asp stack-based overflowEPSS 6.7%CVE-2025-14879CRITICALTenda WH450 HTTP Request onSSIDChange stack-based overflowEPSS 6.7%CVE-2026-11499CRITICALTenda HG7/HG9/HG10 formDOMAINBLK stack-based overflowEPSS 6.6%CVE-2021-27246HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 AC1750 1.0.15 EPSS 6.6%CVE-2025-7086HIGHBelkin F9K1122 webs formPPTPSetup stack-based overflowEPSS 6.4%CVE-2020-15416HIGHThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 rEPSS 6.4%CVE-2025-5572HIGHD-Link DCS-932L setSystemEmail stack-based overflowEPSS 6.3%CVE-2020-9748HIGHStack overflow vulnerability in Adobe Animate 20.5EPSS 6.3%CVE-2014-9190—Schneider Electric Wonderware InTouch Access Anywhere Server Buffer OverflowEPSS 6.2%CVE-2019-13548—CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could causEPSS 6.2%