Fallos del tipo CWE-119

3268 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2026-64698CRITICALThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. AEPSS 0.6%CVE-2026-13588MEDIUMseladb PcapPlusPlus TLS Hello SSLHandshake.cpp getHandshakeVersion heap-based overflowEPSS 0.6%CVE-2026-96257CRITICALFast FAC1203R Gigabit Edition Device Discovery Service copy_msg_element stack-based overflowEPSS 0.6%CVE-2024-7972HIGHInappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially perform out of bounds meEPSS 0.6%CVE-2024-8387CRITICALMemory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruptionEPSS 0.6%CVE-2026-2779CRITICALIncorrect boundary conditions in the Networking: JAR componentEPSS 0.6%CVE-2026-12174HIGHD-Link DCS-935L HTTP rhea snprintf format stringEPSS 0.6%CVE-2025-29366CRITICALIn mupen64plus v2.6.0 there is an array overflow vulnerability in the write_rdram_regs and write_rdram_regs functions, which enables executiEPSS 0.6%CVE-2022-1115—A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulnerability is triggered EPSS 0.6%CVE-2017-7407LOWThe ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from pEPSS 0.6%CVE-2025-3406MEDIUMNothings stb Header Array stbhw_build_tileset_from_image out-of-boundsEPSS 0.6%CVE-2019-15249HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15241HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15248HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15247HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15246HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15240HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15252HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15244HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15251HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%