Fallos del tipo CWE-126

581 resultados

Leitura excessiva de buffer na pilha

Ocorre quando o código lê mais dados de um buffer alocado na pilha do que o tamanho dele permite. O atacante consegue expor dados sensíveis que estão em posições de memória adjacentes (senhas, tokens, dados de outros processos) ou causar crash da aplicação.

Ejemplo

Uma função recebe uma string de 64 bytes na pilha, mas usa strcpy() ou memcpy() sem validar o tamanho real, lendo 128 bytes. Os 64 bytes extras vêm de outras variáveis locais ou frames de função anteriores, expondo informações confidenciais.

Cómo mitigar

Use funções seguras com limite explícito de bytes (strncpy, snprintf, memcpy com tamanho validado) ou linguagens com bounds-checking automático. Valide sempre o tamanho de entrada contra o buffer antes de ler, e use ferramentas estáticas (ASan, Clang Static Analyzer) durante desenvolvimento.

CVE-2026-20538MEDIUMIn Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE hasEPSS 0.2%CVE-2026-20539MEDIUMIn Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has conEPSS 0.2%CVE-2026-20541MEDIUMIn Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE hasEPSS 0.2%CVE-2026-20540MEDIUMIn Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has conEPSS 0.2%CVE-2026-18238MEDIUMOOBR in rpcap client in libpcap before 1.10.7EPSS 0.2%CVE-2026-93524MEDIUMX.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds ReadEPSS 0.2%CVE-2026-11787MEDIUM389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsingEPSS 0.2%CVE-2026-102758HIGHThe `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitivEPSS 0.2%CVE-2026-45684MEDIUMOpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffersEPSS 0.2%CVE-2026-0930LOWPotential wolfSSHd Buffer out-of-bounds Read on Windows Handling Terminal ResizeEPSS 0.2%CVE-2026-90610MEDIUMGPAC MP4Box svg_attributes.c gf_svg_attributes_copy buffer over-readEPSS 0.2%CVE-2026-57546HIGHBuffer Over-read in WLAN HALEPSS 0.2%CVE-2026-2394MEDIUMBuffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.EPSS 0.2%CVE-2026-25294HIGHBuffer Over-read in WLAN FirmwareEPSS 0.2%CVE-2026-24081HIGHBuffer Over-read in BT ControllerEPSS 0.2%CVE-2026-25288HIGHBuffer Over-read in WLAN FirmwareEPSS 0.2%CVE-2026-27798MEDIUMImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small imagesEPSS 0.2%CVE-2025-47402MEDIUMBuffer Over-read in WLAN FirmwareEPSS 0.2%CVE-2026-50813MEDIUMAn issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension chaEPSS 0.2%CVE-2026-21381HIGHBuffer Over-read in WLAN FirmwareEPSS 0.2%