Weaknesses of type CWE-126

480 results

Leitura além dos limites de buffer na pilha

Ocorre quando o código lê dados além do tamanho alocado de um buffer armazenado na pilha (stack). O programa acessa memória que não lhe pertence, podendo expor dados sensíveis como variáveis locais, endereços de retorno ou informações de contexto. Diferente de um buffer overflow, aqui não há escrita destrutiva, mas a leitura não autorizada compromete confidencialidade.

Example

Uma função copia uma string de entrada para um buffer fixo de 64 bytes, mas depois lê 128 bytes desse buffer para enviá-lo a um log remoto. O atacante fornece uma string curta, mas o programa vaza dados armazenados logo após o buffer na pilha (variáveis locais de outras funções, ponteiros).

How to mitigate

Use funções seguras com limite de tamanho (como snprintf em vez de sprintf, strncpy em vez de strcpy). Sempre rastreie e valide o comprimento real dos dados antes de ler. Ative proteções de compilação como stack canaries e AddressSanitizer em desenvolvimento para detectar acessos fora dos limites.

CVE-2023-49285HIGHDenial of Service in HTTP Message Processing in SquidEPSS 88.8%CVE-2017-7668—The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token()EPSS 57.5%CVE-2017-7679—In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious CoEPSS 39.3%CVE-2025-21277HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 37.8%CVE-2024-38071HIGHWindows Remote Desktop Licensing Service Denial of Service VulnerabilityEPSS 35.9%CVE-2009-2495MEDIUMThe Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 200EPSS 34.3%CVE-2024-20290HIGHA vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) EPSS 33.6%CVE-2023-38152MEDIUMDHCP Server Service Information Disclosure VulnerabilityEPSS 24.0%CVE-2023-36397CRITICALWindows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityEPSS 17.5%CVE-2024-26160MEDIUMWindows Cloud Files Mini Filter Driver Information Disclosure VulnerabilityEPSS 11.4%CVE-2019-11036MEDIUMHeap over-read in PHP EXIF extensionEPSS 7.0%CVE-2018-14790—Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. A buffeEPSS 5.4%CVE-2023-38144HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 5.4%CVE-2018-8789—FreeRDP prior to version 2.0.0-rc4 contains several Out-Of-Bounds Reads in the NTLM Authentication module that results in a Denial of ServicEPSS 5.2%CVE-2023-28266MEDIUMWindows Common Log File System Driver Information Disclosure VulnerabilityEPSS 4.4%CVE-2018-8799—rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_secondary_order() that results in a Denial ofEPSS 4.1%CVE-2018-8796—rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_bitmap_updates() that results in a Denial of EPSS 4.1%CVE-2018-8792—rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function cssp_read_tsrequest() that results in a Denial of SerEPSS 4.1%CVE-2018-8798—rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpsnd_process_ping() that results in an information EPSS 3.8%CVE-2018-8791—rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpdr_process() that results in an information leak.EPSS 3.8%