Fallos del tipo CWE-126

581 resultados

Leitura excessiva de buffer na pilha

Ocorre quando o código lê mais dados de um buffer alocado na pilha do que o tamanho dele permite. O atacante consegue expor dados sensíveis que estão em posições de memória adjacentes (senhas, tokens, dados de outros processos) ou causar crash da aplicação.

Ejemplo

Uma função recebe uma string de 64 bytes na pilha, mas usa strcpy() ou memcpy() sem validar o tamanho real, lendo 128 bytes. Os 64 bytes extras vêm de outras variáveis locais ou frames de função anteriores, expondo informações confidenciais.

Cómo mitigar

Use funções seguras com limite explícito de bytes (strncpy, snprintf, memcpy com tamanho validado) ou linguagens com bounds-checking automático. Valide sempre o tamanho de entrada contra o buffer antes de ler, e use ferramentas estáticas (ASan, Clang Static Analyzer) durante desenvolvimento.

CVE-2026-50341MEDIUMWindows NTFS Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-50383MEDIUMWindows Print Spooler Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-62793MEDIUMWindows NTFS Information Disclosure VulnerabilityEPSS 0.4%CVE-2023-28572MEDIUMBuffer Over-read in WLAN HOSTEPSS 0.4%CVE-2025-62464HIGHWindows Projected File System Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-62467HIGHWindows Projected File System Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-62461HIGHWindows Projected File System Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-62462HIGHWindows Projected File System Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-33064HIGHBuffer Over-read in WLAN Host CommunicationEPSS 0.4%CVE-2026-85835MEDIUMServicing Stack Updates Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-45843HIGHslip: bound decode() reads against the compressed packet lengthEPSS 0.4%CVE-2025-62787LOWWazuh Vulnerable to Heap-based Buffer Over-read in DecodeWinevtEPSS 0.4%CVE-2024-12011HIGHA CWE-126 “Buffer Over-read” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The information disclosure cEPSS 0.4%CVE-2022-42768MEDIUMIn wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.EPSS 0.4%CVE-2026-53920HIGHodhcpd DHCPv6 Short IA_NA/IA_PD Body Stack DisclosureEPSS 0.4%CVE-2026-83719MEDIUMServicing Stack Updates Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-34059HIGHApache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()EPSS 0.4%CVE-2023-45919MEDIUMMesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situaEPSS 0.4%CVE-2026-96851MEDIUMWindows Management Instrumentation Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-96848MEDIUMWindows Win32 Kernel Subsystem Information Disclosure VulnerabilityEPSS 0.4%