Weaknesses of type CWE-805

62 results

Acesso a buffer com tamanho incorreto

Ocorre quando o código acessa um buffer (lê ou escreve) usando um tamanho que não corresponde ao tamanho real alocado ou esperado. Isso permite leitura ou escrita além dos limites, causando corrupção de memória, vazamento de dados ou execução de código arbitrário.

Example

Uma função recebe um tamanho de dado como parâmetro e usa esse valor diretamente em memcpy() sem validar se ele não ultrapassa o tamanho real do buffer. Um atacante passa um tamanho maior, provocando overflow e sobrescrita de memória adjacente.

How to mitigate

Sempre validar e limitar o tamanho de acesso ao menor entre o tamanho solicitado e o tamanho real do buffer. Use APIs seguras como strncpy() em vez de strcpy(), e implemente verificações explícitas de limites antes de qualquer leitura ou escrita.

CVE-2024-34476MEDIUMOpen5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: ogs_nas_encrypt in lib/nEPSS 0.5%CVE-2026-34002MEDIUMXorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handlingEPSS 0.5%CVE-2026-8091CRITICALIncorrect boundary conditions in the Audio/Video: Playback componentEPSS 0.5%CVE-2025-20315HIGHA vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unauthenticated, remote EPSS 0.5%CVE-2024-37305HIGHBuffer overflow in deserialization in oqs-provider EPSS 0.4%CVE-2026-92159MEDIUMF´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetryEPSS 0.4%CVE-2025-30651HIGHJunos OS and Junos OS Evolved: Receipt of a specific ICMPv6 packet causes a memory overrun leading to an rpd crashEPSS 0.4%CVE-2026-41035HIGHIn rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. TEPSS 0.4%CVE-2025-20360MEDIUMMultiple Cisco Products Snort 3 MIME Denial of Service VulnerabilityEPSS 0.4%CVE-2026-0716MEDIUMLibsoup: out-of-bounds read in libsoup websocket frame processingEPSS 0.4%CVE-2025-63547HIGHAn issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a crafted packet to the MTU lengEPSS 0.4%CVE-2026-12549MEDIUMLibsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserverEPSS 0.4%CVE-2021-3581HIGHBuffer Access with Incorrect Length Value in zephyrEPSS 0.3%CVE-2025-21591HIGHJunos OS: An unauthenticated adjacent attacker sending a malformed DHCP packet causes jdhcpd to crashEPSS 0.3%CVE-2026-6695MEDIUMGimp: gimp: remote code execution via crafted paa fileEPSS 0.3%CVE-2024-20294MEDIUMA vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthentEPSS 0.3%CVE-2026-1837HIGHlibjxl: Out-of-bounds write in grayscale color transformation when using LCMS2EPSS 0.3%CVE-2026-31607CRITICALusbip: validate number_of_packets in usbip_pack_ret_submit()EPSS 0.3%CVE-2019-19339MEDIUMIt was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the EPSS 0.3%CVE-2026-20290MEDIUMCisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service VulnerabilityEPSS 0.3%