Fallos del tipo CWE-119

3285 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2022-21237MEDIUMImproper buffer access in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via locaEPSS 0.2%CVE-2025-6272MEDIUMwasm3 m3_compile.c MarkSlotAllocated out-of-bounds writeEPSS 0.2%CVE-2025-5555HIGHNixdorf Wincor PORT IO Driver IOCTL wnport.sys sub_11100 stack-based overflowEPSS 0.2%CVE-2026-8212MEDIUMOSGeo gdal SWapi.c SWSDfldsrch heap-based overflowEPSS 0.2%CVE-2026-3147MEDIUMlibvips csvload.c vips_foreign_load_csv_build heap-based overflowEPSS 0.2%CVE-2025-6119MEDIUMOpen Asset Import Library Assimp BVHLoader.cpp ReadNodeChannels use after freeEPSS 0.2%CVE-2026-3281MEDIUMlibvips bandrank.c vips_bandrank_build heap-based overflowEPSS 0.2%CVE-2025-6856MEDIUMHDF5 H5FL.c H5FL__reg_gc_list use after freeEPSS 0.2%CVE-2026-8213MEDIUMOSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflowEPSS 0.2%CVE-2026-2653MEDIUMadmesh normals.c stl_check_normal_vector heap-based overflowEPSS 0.2%CVE-2025-5642LOWRadare2 radiff2 pal.c r_cons_pal_init memory corruptionEPSS 0.2%CVE-2025-5643LOWRadare2 radiff2 cons.c cons_stack_load memory corruptionEPSS 0.2%CVE-2025-5644LOWRadare2 radiff2 cons.c r_cons_flush use after freeEPSS 0.2%CVE-2025-8837MEDIUMJasPer JPEG2000 File jpc_dec.c jpc_dec_dump use after freeEPSS 0.2%CVE-2022-41194—Due to lack of proper memory management, when a victim opens a manipulated Encapsulated Postscript (.eps, ai.x3d) file received from untrustEPSS 0.2%CVE-2024-11139MEDIUMCWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow local attackers to exEPSS 0.2%CVE-2025-7207MEDIUMmruby nregs codegen.c scope_new heap-based overflowEPSS 0.2%CVE-2026-3393MEDIUMjarikomppa soloud Audio File soloud_wav.cpp loadflac heap-based overflowEPSS 0.2%CVE-2025-12205MEDIUMKamailio Configuration File cfg.lex sr_push_yy_state use after freeEPSS 0.2%CVE-2026-2661MEDIUMSquirrel sqobject.h operator heap-based overflowEPSS 0.2%