Fallos del tipo CWE-119

3268 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2024-54551HIGHThe issue was addressed with improved memory handling. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOSEPSS 0.6%CVE-2022-41201HIGHDue to lack of proper memory management, when a victim opens a manipulated Right Hemisphere Binary (.rh, rh.x3d) file received from untrusteEPSS 0.6%CVE-2022-3216MEDIUMNintendo Game Boy Color Mobile Adapter GB Tetsuji memory corruptionEPSS 0.6%CVE-2026-8655HIGHMultiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of ServiceEPSS 0.6%CVE-2022-32588CRITICALAn out-of-bounds write vulnerability exists in the PICT parsing pctwread_14841 functionality of Accusoft ImageGear 20.0. A specially-craftedEPSS 0.6%CVE-2026-82820MEDIUMFLVMeta AMF String Processing amf.c amf_string_new heap-based overflowEPSS 0.6%CVE-2022-39392MEDIUMWasmtime vulnerable to out of bounds read/write with zero-memory-pages configurationEPSS 0.6%CVE-2023-46586CRITICALcgi.c in weborf .0.17, 0.18, 0.19, and 0.20 (before 1.0) lacks '\0' termination of the path for CGI scripts because strncpy is misused.EPSS 0.6%CVE-2025-14187HIGHUGREEN DH2100+ nas_svr create handler_file_backup_create buffer overflowEPSS 0.6%CVE-2026-5683MEDIUMTenda CX12L P2pListFilter fromP2pListFilter stack-based overflowEPSS 0.6%CVE-2026-5245MEDIUMCesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflowEPSS 0.6%CVE-2026-78049MEDIUMSysterel S2OPC AddNodes Service sopc_node_mgt_helper_internal.c out-of-boundsEPSS 0.6%CVE-2024-47796HIGHAn improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file cEPSS 0.6%CVE-2024-52333HIGHAn improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOMEPSS 0.6%CVE-2014-125018MEDIUMFFmpeg decode_slice_header memory corruptionEPSS 0.6%CVE-2014-125010MEDIUMFFmpeg h64.c decode_slice_header memory corruptionEPSS 0.6%CVE-2022-43762HIGHMemory leak when receiving messages in APROL Tbase serverEPSS 0.6%CVE-2025-15460HIGHUTT 进取 520W formPptpClientConfig strcpy buffer overflowEPSS 0.6%CVE-2023-20529HIGHInsufficient bound checks in the SMU may allow an attacker to update the from/to address space to an invalid value potentially resulting in EPSS 0.6%CVE-2023-20531HIGHInsufficient bound checks in the SMU may allow an attacker to update the SRAM from/to address space to an invalid value potentially resultinEPSS 0.6%