Fallos del tipo CWE-119

3510 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2024-24561CRITICALVyper bounds check on built-in `slice()` function can be overflowedEPSS 0.9%CVE-2025-5629HIGHTenda AC10 HTTP SetPptpServerCfg formSetPPTPServer buffer overflowEPSS 0.9%CVE-2023-23517HIGHThe issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS EPSS 0.9%CVE-2025-9791HIGHTenda AC20 fromAdvSetMacMtuWan stack-based overflowEPSS 0.9%CVE-2025-24797CRITICALMeshtastic incorrectly hands malformed packets leads to controlled buffer overflowEPSS 0.9%CVE-2025-9303HIGHTOTOLINK A720R cstecgi.cgi setParentalRules buffer overflowEPSS 0.9%CVE-2025-5869HIGHRT-Thread lwp_syscall.c sys_recvfrom memory corruptionEPSS 0.9%CVE-2026-64726CRITICALThe issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOEPSS 0.9%CVE-2025-12622HIGHTenda AC10 SysRunCmd formSysRunCmd buffer overflowEPSS 0.9%CVE-2023-1972MEDIUMA potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability.EPSS 0.9%CVE-2018-17907—When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with the value of an offset, an attacker can fEPSS 0.9%CVE-2022-4603MEDIUMppp pppdump pppdump.c dumpppp array indexEPSS 0.9%CVE-2025-4896HIGHTenda AC10 UserCongratulationsExec buffer overflowEPSS 0.9%CVE-2025-11408HIGHD-Link DI-7001 MINI dbsrv.asp buffer overflowEPSS 0.9%CVE-2025-13190HIGHD-Link DIR-816L __ajax_exporer.sgi scandir_main stack-based overflowEPSS 0.9%CVE-2021-32492—A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds read in function DJVU::DataPool::has_data() via crafted djvu file may leaEPSS 0.9%CVE-2023-29420MEDIUMAn issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a crash caused by an invalid memmove in bz3_decode_block.EPSS 0.9%CVE-2025-9748HIGHTenda CH22 httpd IPSECsave fromIpsecitem stack-based overflowEPSS 0.9%CVE-2025-10756HIGHUTT HiPER 840G getOneApConfTempEntry buffer overflowEPSS 0.9%CVE-2024-12988MEDIUMNetgear R6900P/R7000P HTTP Header sub_16C4C buffer overflowEPSS 0.9%