Fallos del tipo CWE-121

4140 resultados

Estouro de buffer na pilha

Ocorre quando código escreve dados além dos limites de um buffer alocado na pilha (stack), sobrescrevendo informações críticas como endereços de retorno ou variáveis locais. Um atacante pode explorar isso para executar código arbitrário ou causar crash da aplicação.

Ejemplo

Uma função copia uma string de entrada diretamente em um array de 64 bytes sem validar o tamanho: `char buffer[64]; strcpy(buffer, user_input);` Se o usuário enviar uma string com 200 bytes, ela sobrescreverá o endereço de retorno e pode redirecionar a execução para código malicioso.

Cómo mitigar

Use funções seguras com limite de tamanho (`strncpy`, `snprintf`), valide e sanitize entradas antes de copiar, implemente proteções em tempo de execução (stack canaries, ASLR, DEP) e considere usar linguagens com verificação de limites automática quando possível.

CVE-2025-51085MEDIUMTenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/SetSysTimeCfg. The manipulation of the argument `timeZone` andEPSS 8.6%CVE-2021-23138HIGHWECON LeviStudioUEPSS 8.6%CVE-2020-15636HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R6400, R6700, R7000, R7850, R7900,EPSS 8.5%CVE-2024-27459HIGHThe interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute aEPSS 8.3%CVE-2024-7441HIGHVivotek SD9364 httpd read stack-based overflowEPSS 8.1%CVE-2020-27261—Omron CX-OneEPSS 7.9%CVE-2025-7091HIGHBelkin F9K1122 webs formWlanMP stack-based overflowEPSS 7.9%CVE-2025-5853HIGHTenda AC6 SetRemoteWebCfg formSetSafeWanWebMan stack-based overflowEPSS 7.8%CVE-2021-35003CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer C90 1.0.6 Build 20200114 reEPSS 7.7%CVE-2021-35004HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link TL-WA1201 1.0.1 Build 20200709 relEPSS 7.7%CVE-2023-38148HIGHInternet Connection Sharing (ICS) Remote Code Execution VulnerabilityEPSS 7.7%CVE-2026-1457HIGHAuthenticated RCE Vulnerability Due to Buffer Overflow on TP-Link VIGI C385EPSS 7.6%CVE-2025-62507HIGHRedis: Bug in XACKDEL may lead to stack overflow and potential RCEEPSS 7.5%CVE-2017-14854CRITICALA stack buffer overflow exists in one of the Orpak SiteOmat CGI components, allowing for remote code execution. The vulnerability affects alEPSS 7.4%CVE-2025-3693HIGHTenda W12 httpd cgiWifiRadioSet stack-based overflowEPSS 7.4%CVE-2026-10187CRITICALTotolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflowEPSS 7.3%CVE-2018-17930—A stack-based buffer overflow vulnerability has been identified in Teledyne DALSA Sherlock Version 7.2.7.4 and prior, which may allow remoteEPSS 7.3%CVE-2022-24049CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systeEPSS 7.2%CVE-2025-2097HIGHTOTOLINK EX1800T cstecgi.cgi setRptWizardCfg stack-based overflowEPSS 7.2%CVE-2021-38402HIGHDelta Electronics DOPSoft 2 Stack-Based Buffer OverflowEPSS 7.1%