Fallos del tipo CWE-126

581 resultados

Leitura excessiva de buffer na pilha

Ocorre quando o código lê mais dados de um buffer alocado na pilha do que o tamanho dele permite. O atacante consegue expor dados sensíveis que estão em posições de memória adjacentes (senhas, tokens, dados de outros processos) ou causar crash da aplicação.

Ejemplo

Uma função recebe uma string de 64 bytes na pilha, mas usa strcpy() ou memcpy() sem validar o tamanho real, lendo 128 bytes. Os 64 bytes extras vêm de outras variáveis locais ou frames de função anteriores, expondo informações confidenciais.

Cómo mitigar

Use funções seguras com limite explícito de bytes (strncpy, snprintf, memcpy com tamanho validado) ou linguagens com bounds-checking automático. Valide sempre o tamanho de entrada contra o buffer antes de ler, e use ferramentas estáticas (ASan, Clang Static Analyzer) durante desenvolvimento.

CVE-2021-34308—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll libEPSS 1.4%CVE-2021-34302—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll libEPSS 1.4%CVE-2021-34325—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library EPSS 1.4%CVE-2021-34307—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_Loader.dll liEPSS 1.4%CVE-2021-34321—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The VisDraw.dll librarEPSS 1.4%CVE-2021-34320—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library EPSS 1.4%CVE-2021-34299—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_loader.dll liEPSS 1.4%CVE-2021-34304—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_Loader.dll liEPSS 1.4%CVE-2021-34303—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_Loader.dll liEPSS 1.4%CVE-2024-38265HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.4%CVE-2026-20846HIGHGDI+ Denial of Service VulnerabilityEPSS 1.4%CVE-2020-3399HIGHCisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Denial of Service VulnerabilityEPSS 1.4%CVE-2019-1010220—tcpdump.org tcpdump 4.9.2 is affected by: CWE-126: Buffer Over-read. The impact is: May expose Saved Frame Pointer, Return Address etc. on sEPSS 1.3%CVE-2021-1588HIGHCisco NX-OS Software MPLS OAM Denial of Service VulnerabilityEPSS 1.3%CVE-2022-2175HIGHBuffer Over-read in vim/vimEPSS 1.3%CVE-2026-83685MEDIUMWindows Internet Key Exchange (IKE) Extension Denial of Service VulnerabilityEPSS 1.3%CVE-2022-20714HIGHCisco IOS XR Software for ASR 9000 Series Routers Lightspeed-Plus Line Cards Denial of Service VulnerabilityEPSS 1.3%CVE-2020-25853—The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not vaEPSS 1.3%CVE-2023-21720MEDIUMMicrosoft Edge (Chromium-based) Tampering VulnerabilityEPSS 1.2%CVE-2021-34322—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The JPEG2K_Loader.dll EPSS 1.2%