Fallos del tipo CWE-126

527 resultados

Leitura excessiva de buffer na pilha

Ocorre quando o código lê mais dados de um buffer alocado na pilha do que o tamanho dele permite. O atacante consegue expor dados sensíveis que estão em posições de memória adjacentes (senhas, tokens, dados de outros processos) ou causar crash da aplicação.

Ejemplo

Uma função recebe uma string de 64 bytes na pilha, mas usa strcpy() ou memcpy() sem validar o tamanho real, lendo 128 bytes. Os 64 bytes extras vêm de outras variáveis locais ou frames de função anteriores, expondo informações confidenciais.

Cómo mitigar

Use funções seguras com limite explícito de bytes (strncpy, snprintf, memcpy com tamanho validado) ou linguagens com bounds-checking automático. Valide sempre o tamanho de entrada contra o buffer antes de ler, e use ferramentas estáticas (ASan, Clang Static Analyzer) durante desenvolvimento.

CVE-2026-62793MEDIUMWindows NTFS Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-69582HIGHWindows Volume Manager Extension Driver Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-55093MEDIUMOut of bound read and write in _nx_ipv4_packet_receive() when handling unicast DHCP messagesEPSS 0.3%CVE-2021-22563MEDIUMMemory Overread in libjxlEPSS 0.3%CVE-2024-49838HIGHBuffer Over-read in WLAN HOSTEPSS 0.3%CVE-2025-11616MEDIUMBuffer Over-read when receiving improperly sized ICMPv6 packets in FreeRTOS-Plus-TCPEPSS 0.3%CVE-2025-11617MEDIUMBuffer Over-read when receiving IPv6 packets with incorrect payload length in FreeRTOS-Plus-TCPEPSS 0.3%CVE-2026-55238MEDIUMxrdp: Malformed Confirm Active capability sets cause out-of-bounds readsEPSS 0.3%CVE-2023-20112HIGHCisco Access Point Software Association Request Denial of Service VulnerabilityEPSS 0.3%CVE-2026-64905HIGHMicrosoft Office Word Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-60729MEDIUMPerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath functionEPSS 0.3%CVE-2026-25275HIGHBuffer Over-read in WLAN FirmwareEPSS 0.3%CVE-2023-24849HIGHBuffer Over-read in Data ModemEPSS 0.3%CVE-2023-24848HIGHBuffer Over-read in Data ModemEPSS 0.3%CVE-2026-76653MEDIUMMissing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600EPSS 0.3%CVE-2026-68851MEDIUMWindows NTFS Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-69316MEDIUMWindows Overlay Filter Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-33048HIGHBuffer Over-read in WLAN HostEPSS 0.3%CVE-2024-33051HIGHBuffer Over-read in WLAN FirmwareEPSS 0.3%CVE-2024-23364HIGHBuffer Over-read in WLAN FirmwareEPSS 0.3%