Fallos del tipo CWE-121

3848 resultados

Estouro de buffer na pilha

Ocorre quando código escreve dados além dos limites de um buffer alocado na pilha (stack), sobrescrevendo informações críticas como endereços de retorno ou variáveis locais. Um atacante pode explorar isso para executar código arbitrário ou causar crash da aplicação.

Ejemplo

Uma função copia uma string de entrada diretamente em um array de 64 bytes sem validar o tamanho: `char buffer[64]; strcpy(buffer, user_input);` Se o usuário enviar uma string com 200 bytes, ela sobrescreverá o endereço de retorno e pode redirecionar a execução para código malicioso.

Cómo mitigar

Use funções seguras com limite de tamanho (`strncpy`, `snprintf`), valide e sanitize entradas antes de copiar, implemente proteções em tempo de execução (stack canaries, ASLR, DEP) e considere usar linguagens com verificação de limites automática quando possível.

CVE-2026-48417HIGHSubstance3D - Sampler | Stack-based Buffer Overflow (CWE-121)EPSS 0.3%CVE-2026-47959HIGHAcrobat Reader | Stack-based Buffer Overflow (CWE-121)EPSS 0.3%CVE-2026-47971HIGHMedia Encoder | Stack-based Buffer Overflow (CWE-121)EPSS 0.3%CVE-2026-34697HIGHInDesign Desktop | Stack-based Buffer Overflow (CWE-121)EPSS 0.3%CVE-2026-27267HIGHIllustrator | Stack-based Buffer Overflow (CWE-121)EPSS 0.3%CVE-2019-10974—NREL EnergyPlus, Versions 8.6.0 and possibly prior versions, The application fails to prevent an exception handler from being overwritten wiEPSS 0.3%CVE-2026-18681MEDIUMThis Power System Buffer OverflowEPSS 0.3%CVE-2009-20003HIGHXenorate <= 2.50 .xpl File Stack-Based Buffer OverflowEPSS 0.3%CVE-2025-8076HIGHA stack buffer overflow vulnerability exists in the Supermicro BMC Web functionEPSS 0.3%CVE-2026-12488MEDIUMGeoVision GV-VMS V20 GV-Cloud memory corruption vulnerabilityEPSS 0.3%CVE-2025-8727HIGHA stack buffer overflow vulnerability exists in the Supermicro BMC Web function(SSL).EPSS 0.3%CVE-2025-46405HIGHBIG-IP APM vulnerabilityEPSS 0.3%CVE-2026-67560HIGHStack-based Buffer Overflow in Bendix EC80 Brake ECUEPSS 0.3%CVE-2024-25331CRITICALDIR-822 Rev. B Firmware v2.02KRB09 and DIR-822-CA Rev. B Firmware v2.03WWb01 suffer from a LAN-Side Unauthenticated Remote Code Execution (REPSS 0.3%CVE-2025-67432HIGHA stack overflow in the ZBarcode_Encode function of Monkeybread Software MBS DynaPDF Plugin v21.3.1.1 allows attackers to cause a Denial of EPSS 0.3%CVE-2026-0399MEDIUMMultiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to improper bounds checkingEPSS 0.3%CVE-2026-71337HIGHWindows Storage Management Provider Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-50400HIGHWindows App Package Installer Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-66877HIGHBuffer overflow vulnerability in function dcputchar in decompile.c in libming 0.4.8.EPSS 0.3%CVE-2026-50387HIGHWindows GDI Elevation of Privilege VulnerabilityEPSS 0.3%