Fallos del tipo CWE-121

3823 resultados

Estouro de buffer na pilha

Ocorre quando código escreve dados além dos limites de um buffer alocado na pilha (stack), sobrescrevendo informações críticas como endereços de retorno ou variáveis locais. Um atacante pode explorar isso para executar código arbitrário ou causar crash da aplicação.

Ejemplo

Uma função copia uma string de entrada diretamente em um array de 64 bytes sem validar o tamanho: `char buffer[64]; strcpy(buffer, user_input);` Se o usuário enviar uma string com 200 bytes, ela sobrescreverá o endereço de retorno e pode redirecionar a execução para código malicioso.

Cómo mitigar

Use funções seguras com limite de tamanho (`strncpy`, `snprintf`), valide e sanitize entradas antes de copiar, implemente proteções em tempo de execução (stack canaries, ASLR, DEP) e considere usar linguagens com verificação de limites automática quando possível.

CVE-2017-16724—A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple instances of a vulnerabiEPSS 2.6%CVE-2021-44165—A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER MEPSS 2.6%CVE-2025-5630CRITICALD-Link DIR-816 form2lansetup.cgi stack-based overflowEPSS 2.6%CVE-2020-10599—VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow a vulnerable ActiveX component to be exploited resulting in a buffEPSS 2.6%CVE-2020-10615—Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 allows remote attackers cause a denial-of-servicEPSS 2.6%CVE-2023-21604HIGHAdobe Acrobat Reader Stack-based Buffer Overflow Arbitrary code executionEPSS 2.6%CVE-2026-3808HIGHTenda FH1202 webtypelibrary formWebTypeLibrary stack-based overflowEPSS 2.6%CVE-2023-21610HIGHAdobe Acrobat Reader Stack-based Buffer Overflow Arbitrary code executionEPSS 2.5%CVE-2022-38752MEDIUMDoS in SnakeYAMLEPSS 2.5%CVE-2024-30083HIGHWindows Standards-Based Storage Management Service Denial of Service VulnerabilityEPSS 2.5%CVE-2024-35388HIGHTOTOLINK NR1800X v9.1.0u.6681_B20230703 was discovered to contain a stack overflow via the password parameter in the function urldecodeEPSS 2.5%CVE-2014-0753—Ecava IntegraXor Stack-based Buffer OverflowEPSS 2.5%CVE-2026-4747HIGHRemote code execution via RPCSEC_GSS packet validationEPSS 2.5%CVE-2021-43299—Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since iEPSS 2.5%CVE-2025-5624CRITICALD-Link DIR-816 QoSPortSetup stack-based overflowEPSS 2.5%CVE-2025-5622CRITICALD-Link DIR-816 wirelessApcli_5g stack-based overflowEPSS 2.5%CVE-2018-14318—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S8 G950FXXU1AQL5. User inEPSS 2.5%CVE-2019-8263—UltraVNC revision 1205 has stack-based buffer overflow vulnerability in VNC client code inside ShowConnInfo routine, which leads to a denialEPSS 2.5%CVE-2026-5204HIGHTenda CH22 Parameter webtypelibrary formWebTypeLibrary stack-based overflowEPSS 2.5%CVE-2025-24052HIGHWindows Agere Modem Driver Elevation of Privilege VulnerabilityEPSS 2.5%