Fallos del tipo CWE-126

581 resultados

Leitura excessiva de buffer na pilha

Ocorre quando o código lê mais dados de um buffer alocado na pilha do que o tamanho dele permite. O atacante consegue expor dados sensíveis que estão em posições de memória adjacentes (senhas, tokens, dados de outros processos) ou causar crash da aplicação.

Ejemplo

Uma função recebe uma string de 64 bytes na pilha, mas usa strcpy() ou memcpy() sem validar o tamanho real, lendo 128 bytes. Os 64 bytes extras vêm de outras variáveis locais ou frames de função anteriores, expondo informações confidenciais.

Cómo mitigar

Use funções seguras com limite explícito de bytes (strncpy, snprintf, memcpy com tamanho validado) ou linguagens com bounds-checking automático. Valide sempre o tamanho de entrada contra o buffer antes de ler, e use ferramentas estáticas (ASan, Clang Static Analyzer) durante desenvolvimento.

CVE-2026-50468MEDIUMMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-73029MEDIUMMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-67393MEDIUMMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-67390MEDIUMMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 1.0%CVE-2023-36803MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-68819MEDIUMWindows Network File System Denial of Service VulnerabilityEPSS 1.0%CVE-2026-83888MEDIUMWindows CD-ROM Driver Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2026-97828MEDIUMRole: DNS Server Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-69550MEDIUMWindows App for Mac Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-69626MEDIUMMicrosoft Office Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-50445MEDIUMWindows Remote Desktop Protocol (RDP) Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-65794MEDIUMWindows SMB Client Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-50504MEDIUMWindows Remote Desktop Client Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-72974MEDIUMMicrosoft Office Excel Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-69719MEDIUMMicrosoft Office Word Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-26155MEDIUMMicrosoft Local Security Authority Subsystem Service Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-83835MEDIUMWindows Common Log File System Driver Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-88167MEDIUMMicrosoft Office Word Information Disclosure VulnerabilityEPSS 0.9%CVE-2024-38261HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2022-1987LOWBuffer Over-read in bfabiszewski/libmobiEPSS 0.8%