Fallos del tipo CWE-121

3823 resultados

Estouro de buffer na pilha

Ocorre quando código escreve dados além dos limites de um buffer alocado na pilha (stack), sobrescrevendo informações críticas como endereços de retorno ou variáveis locais. Um atacante pode explorar isso para executar código arbitrário ou causar crash da aplicação.

Ejemplo

Uma função copia uma string de entrada diretamente em um array de 64 bytes sem validar o tamanho: `char buffer[64]; strcpy(buffer, user_input);` Se o usuário enviar uma string com 200 bytes, ela sobrescreverá o endereço de retorno e pode redirecionar a execução para código malicioso.

Cómo mitigar

Use funções seguras com limite de tamanho (`strncpy`, `snprintf`), valide e sanitize entradas antes de copiar, implemente proteções em tempo de execução (stack canaries, ASLR, DEP) e considere usar linguagens com verificação de limites automática quando possível.

CVE-2025-2621CRITICALD-Link DAP-1620 storage check_dws_cookie stack-based overflowEPSS 2.1%CVE-2021-43556HIGHFATEK Automation WinProladderEPSS 2.1%CVE-2021-46638HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2022-38749MEDIUMDoS in SnakeYAMLEPSS 2.1%CVE-2021-26561CRITICALStack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-theEPSS 2.1%CVE-2022-24355HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 2EPSS 2.1%CVE-2022-29496CRITICALA stack-based buffer overflow vulnerability exists in the BlynkConsole.h runCommand functionality of Blynk -Library v1.0.1. A specially-crafEPSS 2.0%CVE-2021-34892HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.0%CVE-2021-46585HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.0%CVE-2021-34941HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.0%CVE-2021-4464CRITICALFIberHome AN5506-04-FA / HG6245D Routers Remote Stack OverflowEPSS 2.0%CVE-2024-1783CRITICALTotolink LR1200GB Web Interface cstecgi.cgi loginAuth stack-based overflowEPSS 2.0%CVE-2025-2619CRITICALD-Link DAP-1620 Cookie storage check_dws_cookie stack-based overflowEPSS 2.0%CVE-2016-5800—A malicious attacker can trigger a remote buffer overflow in the Communication Server in Fatek Automation PM Designer V3 Version 2.1.2.2, anEPSS 2.0%CVE-2024-36493CRITICALA stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic() functionality of Wavlink AC3000 M33A8.V5030.210505. EPSS 2.0%CVE-2020-27281—A stack-based buffer overflow may exist in Delta Electronics CNCSoft ScreenEditor versions 1.01.26 and prior when processing specially craftEPSS 2.0%CVE-2021-46565HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.0%CVE-2023-40476HIGHGStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 2.0%CVE-2024-47072HIGHXStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input streamEPSS 2.0%CVE-2023-0250HIGHCVE-2023-0250EPSS 2.0%