Fallos del tipo CWE-126

581 resultados

Leitura excessiva de buffer na pilha

Ocorre quando o código lê mais dados de um buffer alocado na pilha do que o tamanho dele permite. O atacante consegue expor dados sensíveis que estão em posições de memória adjacentes (senhas, tokens, dados de outros processos) ou causar crash da aplicação.

Ejemplo

Uma função recebe uma string de 64 bytes na pilha, mas usa strcpy() ou memcpy() sem validar o tamanho real, lendo 128 bytes. Os 64 bytes extras vêm de outras variáveis locais ou frames de função anteriores, expondo informações confidenciais.

Cómo mitigar

Use funções seguras com limite explícito de bytes (strncpy, snprintf, memcpy com tamanho validado) ou linguagens com bounds-checking automático. Valide sempre o tamanho de entrada contra o buffer antes de ler, e use ferramentas estáticas (ASan, Clang Static Analyzer) durante desenvolvimento.

CVE-2024-49847HIGHBuffer Over-read in Multi-Mode Call ProcessorEPSS 0.3%CVE-2023-4758MEDIUMBuffer Over-read in gpac/gpacEPSS 0.3%CVE-2024-9843MEDIUMA buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to cause a denial of service.EPSS 0.3%CVE-2024-53020HIGHBuffer Over-read in Data Network Stack & ConnectivityEPSS 0.3%CVE-2024-53021HIGHBuffer Over-read in Data Network Stack & ConnectivityEPSS 0.3%CVE-2025-27029HIGHBuffer Over-read in WLAN HALEPSS 0.3%CVE-2024-53019HIGHBuffer Over-read in Data Network Stack & ConnectivityEPSS 0.3%CVE-2025-27065HIGHBuffer Over-read in WLAN FirmwareEPSS 0.3%CVE-2024-38405HIGHBuffer Over-read in WLAN HostEPSS 0.3%CVE-2024-38403HIGHBuffer Over-read in WLAN FirmwareEPSS 0.3%CVE-2026-20311MEDIUMCisco IOS XE Software Web UI Denial of Service VulnerabilityEPSS 0.3%CVE-2024-38404HIGHBuffer Over-read in Multi Mode Call ProcessorEPSS 0.3%CVE-2026-65936MEDIUMRS9116W/SiWx917 malformed packet with increased length field causes memory leakEPSS 0.3%CVE-2026-65933MEDIUMBT122 malformed packet with increased length field causes memory leakEPSS 0.3%CVE-2025-55083MEDIUMBroken bounds check in Broken bounds check in _nx_secure_tls_process_clienthello_psk_extension()EPSS 0.3%CVE-2024-57970MEDIUMlibarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive becEPSS 0.3%CVE-2026-124317MEDIUMlibexpat through 2.10.0 Out-of-Bounds Read via unknown_toUtf8 and unknown_toUtf16EPSS 0.2%CVE-2025-27057HIGHBuffer Over-read in WLAN HostEPSS 0.2%CVE-2025-47326HIGHBuffer Over-read in WLAN HALEPSS 0.2%CVE-2026-102728MEDIUMOut-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)EPSS 0.2%