Fallos del tipo CWE-119

3263 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2026-7857HIGHD-Link DI-8100 CGI user_group.asp sprintf buffer overflowEPSS 4.2%CVE-2019-12806—UniSign 2.0.4.0 and earlier version contains a stack-based buffer overflow vulnerability which can overwrite the stack with arbitrary data, EPSS 4.1%CVE-2019-15992HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Code Execution VulnerabilityEPSS 4.1%CVE-2019-11933—A heap buffer overflow bug in libpl_droidsonroids_gif before 1.2.19, as used in WhatsApp for Android before version 2.19.291 could allow remEPSS 4.1%CVE-2016-1421—A vulnerability in the web application for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileEPSS 4.1%CVE-2026-0840HIGHUTT 进取 520W formConfigNoticeConfig strcpy buffer overflowEPSS 4.1%CVE-2026-7851HIGHD-Link DI-8100 yyxz.asp sprintf stack-based overflowEPSS 4.1%CVE-2022-3435MEDIUMLinux Kernel IPv4 fib_semantics.c fib_nh_match out-of-boundsEPSS 4.1%CVE-2017-15126—A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure EPSS 4.1%CVE-2025-10773HIGHB-Link BL-AC2100 Web Management set_delshrpath_cfg delshrpath stack-based overflowEPSS 4.0%CVE-2019-11929—Insufficient boundary checks when formatting numbers in number_format allows read/write access to out-of-bounds memory, potentially leading EPSS 4.0%CVE-2022-3559MEDIUMExim Regex use after freeEPSS 4.0%CVE-2025-10443HIGHTenda AC9/AC15 exeCommand formexeCommand buffer overflowEPSS 4.0%CVE-2025-15356HIGHTenda AC20 PowerSaveSet sscanf buffer overflowEPSS 4.0%CVE-2018-10873HIGHA vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bouEPSS 3.9%CVE-2025-9363HIGHLinksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 portTriggerManageRule stack-based overflowEPSS 3.9%CVE-2020-3375CRITICALCisco SD-WAN Solution Software Buffer Overflow VulnerabilityEPSS 3.9%CVE-2025-13445HIGHTenda AC21 SetIpMacBind stack-based overflowEPSS 3.9%CVE-2025-13446HIGHTenda AC21 SetSysTimeCfg stack-based overflowEPSS 3.9%CVE-2017-1000101MEDIUMcurl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence ofEPSS 3.9%