Fallos del tipo CWE-126

527 resultados

Leitura excessiva de buffer na pilha

Ocorre quando o código lê mais dados de um buffer alocado na pilha do que o tamanho dele permite. O atacante consegue expor dados sensíveis que estão em posições de memória adjacentes (senhas, tokens, dados de outros processos) ou causar crash da aplicação.

Ejemplo

Uma função recebe uma string de 64 bytes na pilha, mas usa strcpy() ou memcpy() sem validar o tamanho real, lendo 128 bytes. Os 64 bytes extras vêm de outras variáveis locais ou frames de função anteriores, expondo informações confidenciais.

Cómo mitigar

Use funções seguras com limite explícito de bytes (strncpy, snprintf, memcpy com tamanho validado) ou linguagens com bounds-checking automático. Valide sempre o tamanho de entrada contra o buffer antes de ler, e use ferramentas estáticas (ASan, Clang Static Analyzer) durante desenvolvimento.

CVE-2026-50372HIGHWindows Redirected Drive Buffering System Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-23359HIGHBuffer Over-read in Multi Mode Call ProcessorEPSS 0.3%CVE-2024-23358HIGHBuffer Over-read in Multi Mode Call ProcessorEPSS 0.3%CVE-2025-63602HIGHA vulnerability was discovered in Awesome Miner thru 11.2.4 that allows arbitrary read and write to kernel memory and MSRs (such as LSTAR) aEPSS 0.3%CVE-2024-21467MEDIUMBuffer Over-read in WLAN Host CommunicationEPSS 0.3%CVE-2026-84640HIGHOne byte overflow read in mail parserEPSS 0.3%CVE-2024-23363HIGHBuffer Over-read in WLAN FirmwareEPSS 0.3%CVE-2024-21459MEDIUMBuffer Over-read in WLAN HOSTEPSS 0.3%CVE-2023-4758MEDIUMBuffer Over-read in gpac/gpacEPSS 0.3%CVE-2024-45552HIGHBuffer Over-read in Data Network Stack & ConnectivityEPSS 0.3%CVE-2026-40210MEDIUMOut-of-bounds read in SetMacAddrActionEPSS 0.3%CVE-2025-21484HIGHBuffer Over-read in Data Network Stack & ConnectivityEPSS 0.3%CVE-2025-21487HIGHBuffer Over-read in Data Network Stack & ConnectivityEPSS 0.3%CVE-2025-21434HIGHBuffer Over-read in WLAN HostEPSS 0.3%CVE-2025-21430HIGHBuffer Over-read in WLAN HostEPSS 0.3%CVE-2025-21429HIGHBuffer Over-read in WLAN HostEPSS 0.3%CVE-2025-21435HIGHBuffer Over-read in WLAN Host CommunicationEPSS 0.3%CVE-2025-21448HIGHBuffer Over-read in WLAN FirmwareEPSS 0.3%CVE-2024-9843MEDIUMA buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to cause a denial of service.EPSS 0.3%CVE-2024-38405HIGHBuffer Over-read in WLAN HostEPSS 0.3%