Fallos del tipo CWE-119

3273 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2026-39870HIGHThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. PEPSS 0.4%CVE-2025-14333HIGHMemory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146EPSS 0.4%CVE-2026-10066HIGHShibby Tomato UPS Service tomatoups.cgi sub_9068 stack-based overflowEPSS 0.4%CVE-2026-10067HIGHShibby Tomato multimon.cgi sub_90F0 stack-based overflowEPSS 0.4%CVE-2026-10065HIGHShibby Tomato tomatodata.cgi get_ups_field stack-based overflowEPSS 0.4%CVE-2026-14383HIGHInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandEPSS 0.4%CVE-2025-2357MEDIUMDCMTK dcmjpls JPEG-LS Decoder memory corruptionEPSS 0.4%CVE-2024-10498MEDIUMCWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow an unauthorized attacEPSS 0.4%CVE-2026-14407HIGHInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandEPSS 0.4%CVE-2023-35970HIGHMultiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chain_table parsing functionality of GTKWave 3.3.115. EPSS 0.4%CVE-2023-35955HIGHMultiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A speEPSS 0.4%CVE-2023-35956HIGHMultiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A speEPSS 0.4%CVE-2023-35958HIGHMultiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A speEPSS 0.4%CVE-2021-1251HIGHCisco Small Business RV Series Routers Link Layer Discovery Protocol VulnerabilitiesEPSS 0.4%CVE-2025-1866CRITICALUndefined Behavior Due to Out-of-Bounds Pointer Arithmetic in libwebsocketsEPSS 0.4%CVE-2021-1308HIGHCisco Small Business RV Series Routers Link Layer Discovery Protocol VulnerabilitiesEPSS 0.4%CVE-2023-42078HIGHPDF-XChange Editor JP2 File Parsing Memory Corruption Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-4719HIGHIncorrect boundary conditions in the Graphics: Text componentEPSS 0.4%CVE-2023-42047HIGHPDF-XChange Editor JP2 File Parsing Memory Corruption Remote Code Execution VulnerabilityEPSS 0.4%CVE-2022-4291HIGHAswjsflt.dll in Avast Antivirus windows caused a crash of the Mozilla Firefox browser due to heap corruptionEPSS 0.4%