Fallos del tipo CWE-126

526 resultados

Leitura excessiva de buffer na pilha

Ocorre quando o código lê mais dados de um buffer alocado na pilha do que o tamanho dele permite. O atacante consegue expor dados sensíveis que estão em posições de memória adjacentes (senhas, tokens, dados de outros processos) ou causar crash da aplicação.

Ejemplo

Uma função recebe uma string de 64 bytes na pilha, mas usa strcpy() ou memcpy() sem validar o tamanho real, lendo 128 bytes. Os 64 bytes extras vêm de outras variáveis locais ou frames de função anteriores, expondo informações confidenciais.

Cómo mitigar

Use funções seguras com limite explícito de bytes (strncpy, snprintf, memcpy com tamanho validado) ou linguagens com bounds-checking automático. Valide sempre o tamanho de entrada contra o buffer antes de ler, e use ferramentas estáticas (ASan, Clang Static Analyzer) durante desenvolvimento.

CVE-2022-40503HIGHBuffer over-read in Bluetooth Host.EPSS 0.4%CVE-2026-50341MEDIUMWindows NTFS Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-50383MEDIUMWindows Print Spooler Information Disclosure VulnerabilityEPSS 0.4%CVE-2023-28572MEDIUMBuffer Over-read in WLAN HOSTEPSS 0.4%CVE-2025-62467HIGHWindows Projected File System Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-60720HIGHWindows Transport Driver Interface (TDI) Translation Driver Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-62464HIGHWindows Projected File System Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-62461HIGHWindows Projected File System Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-62462HIGHWindows Projected File System Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-83949MEDIUMMicrosoft Office Word Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-83951MEDIUMMicrosoft Office Word Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-33064HIGHBuffer Over-read in WLAN Host CommunicationEPSS 0.4%CVE-2025-66692HIGHA buffer over-read in the PublicKey::verify() method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a DenialEPSS 0.4%CVE-2024-12011HIGHA CWE-126 “Buffer Over-read” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The information disclosure cEPSS 0.4%CVE-2026-69794MEDIUMWindows Encrypting File System (EFS) Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-34059HIGHApache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()EPSS 0.4%CVE-2026-53414MEDIUMZoom Clients - Buffer Over-readEPSS 0.4%CVE-2023-45919MEDIUMMesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situaEPSS 0.4%CVE-2026-62730MEDIUMWindows Wired AutoConfig Service Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-61347MEDIUMWindows Event Logging Service Information Disclosure VulnerabilityEPSS 0.4%