Fallos del tipo CWE-805

57 resultados

Acesso a buffer com valor de comprimento incorreto

O código acessa um buffer usando um valor de comprimento que não corresponde ao tamanho real alocado, permitindo leitura ou escrita além dos limites. Isso ocorre quando há desajuste entre o tamanho declarado e o tamanho efetivo do buffer, causando corrupção de memória ou exposição de dados sensíveis.

Ejemplo

Um programa aloca 256 bytes para um buffer, mas usa uma variável com valor 512 em uma operação de cópia ou leitura, acessando 256 bytes além do permitido. Ou ainda: uma função recebe um parâmetro de tamanho fornecido pelo usuário sem validar se é compatível com o buffer alocado.

Cómo mitigar

Sempre validar que o comprimento fornecido (seja de entrada, parâmetro ou fonte externa) não ultrapassa o tamanho real do buffer antes de qualquer operação. Use funções seguras que exigem o tamanho explícito (como strncpy em vez de strcpy) e mantenha invariantes claros entre alocação e uso.

CVE-2024-37305HIGHBuffer overflow in deserialization in oqs-provider EPSS 0.4%CVE-2025-20315HIGHA vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unauthenticated, remote EPSS 0.4%CVE-2026-53877MEDIUMHeap buffer over-read in GDALRasterEPSS 0.4%CVE-2025-30651HIGHJunos OS and Junos OS Evolved: Receipt of a specific ICMPv6 packet causes a memory overrun leading to an rpd crashEPSS 0.4%CVE-2026-12549MEDIUMLibsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserverEPSS 0.4%CVE-2026-41035HIGHIn rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. TEPSS 0.4%CVE-2025-20360MEDIUMMultiple Cisco Products Snort 3 MIME Denial of Service VulnerabilityEPSS 0.4%CVE-2026-12087CRITICALSocket versions before 2.041 for Perl have an out-of-bounds heap readEPSS 0.4%CVE-2026-0716MEDIUMLibsoup: out-of-bounds read in libsoup websocket frame processingEPSS 0.4%CVE-2025-63547HIGHAn issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a crafted packet to the MTU lengEPSS 0.4%CVE-2021-3581HIGHBuffer Access with Incorrect Length Value in zephyrEPSS 0.3%CVE-2025-21591HIGHJunos OS: An unauthenticated adjacent attacker sending a malformed DHCP packet causes jdhcpd to crashEPSS 0.3%CVE-2024-20294MEDIUMA vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthentEPSS 0.3%CVE-2026-31607CRITICALusbip: validate number_of_packets in usbip_pack_ret_submit()EPSS 0.3%CVE-2019-19339MEDIUMIt was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the EPSS 0.3%CVE-2026-1837HIGHlibjxl: Out-of-bounds write in grayscale color transformation when using LCMS2EPSS 0.3%CVE-2020-10774—A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl subsystem when reading the /proc/sys/kEPSS 0.3%CVE-2026-1767MEDIUMLocalsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tagsEPSS 0.2%CVE-2026-6695MEDIUMGimp: gimp: remote code execution via crafted paa fileEPSS 0.2%CVE-2025-20191HIGHMultiple Cisco Products Denial of Service VulnerabilityEPSS 0.2%