Fallos del tipo CWE-119

3507 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2024-22391HIGHA heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A spEPSS 1.4%CVE-2026-7069HIGHD-Link DIR-825 miniupnpd upnpsoap.c AddPortMapping buffer overflowEPSS 1.4%CVE-2024-45169CRITICALAn issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and iEPSS 1.4%CVE-2019-13522—An attacker could use a specially crafted project file to corrupt the memory and execute code under the privileges of the EZ PLC Editor VersEPSS 1.4%CVE-2024-20082CRITICALIn Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote code execution with no additional eEPSS 1.4%CVE-2025-5799HIGHTenda AC8 WifiExtraSet fromSetWirelessRepeat stack-based overflowEPSS 1.4%CVE-2025-5798HIGHTenda AC8 SetSysTimeCfg fromSetSysTime stack-based overflowEPSS 1.4%CVE-2025-1153LOWGNU Binutils format.c bfd_set_format memory corruptionEPSS 1.4%CVE-2021-27397—A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validEPSS 1.4%CVE-2025-7085HIGHBelkin F9K1122 webs formiNICWpsStart stack-based overflowEPSS 1.4%CVE-2026-120189CRITICALD-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflowEPSS 1.3%CVE-2025-9089HIGHTenda AC20 SetIpMacBind sub_48E628 stack-based overflowEPSS 1.3%CVE-2020-25690—An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens.EPSS 1.3%CVE-2025-5600CRITICALTOTOLINK EX1200T cstecgi.cgi setLanguageCfg stack-based overflowEPSS 1.3%CVE-2025-11294HIGHBelkin F9K1015 formL2TPSetup buffer overflowEPSS 1.3%CVE-2022-30938—A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versEPSS 1.3%CVE-2025-6146HIGHTOTOLINK X15 HTTP POST Request formSysLog buffer overflowEPSS 1.3%CVE-2025-4843HIGHD-Link DCS-932L udev SubUPnPCSInit stack-based overflowEPSS 1.3%CVE-2025-4841HIGHD-Link DCS-932L gpio sub_404780 stack-based overflowEPSS 1.3%CVE-2025-4842HIGHD-Link DCS-932L ucp isUCPCameraNameChanged stack-based overflowEPSS 1.3%