Fallos del tipo CWE-805

62 resultados

Acesso a buffer com valor de comprimento incorreto

O código acessa um buffer usando um valor de comprimento que não corresponde ao tamanho real alocado, permitindo leitura ou escrita além dos limites. Isso ocorre quando há desajuste entre o tamanho declarado e o tamanho efetivo do buffer, causando corrupção de memória ou exposição de dados sensíveis.

Ejemplo

Um programa aloca 256 bytes para um buffer, mas usa uma variável com valor 512 em uma operação de cópia ou leitura, acessando 256 bytes além do permitido. Ou ainda: uma função recebe um parâmetro de tamanho fornecido pelo usuário sem validar se é compatível com o buffer alocado.

Cómo mitigar

Sempre validar que o comprimento fornecido (seja de entrada, parâmetro ou fonte externa) não ultrapassa o tamanho real do buffer antes de qualquer operação. Use funções seguras que exigem o tamanho explícito (como strncpy em vez de strcpy) e mantenha invariantes claros entre alocação e uso.

CVE-2024-34476MEDIUMOpen5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: ogs_nas_encrypt in lib/nEPSS 0.5%CVE-2026-34002MEDIUMXorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handlingEPSS 0.5%CVE-2026-8091CRITICALIncorrect boundary conditions in the Audio/Video: Playback componentEPSS 0.5%CVE-2025-20315HIGHA vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unauthenticated, remote EPSS 0.5%CVE-2024-37305HIGHBuffer overflow in deserialization in oqs-provider EPSS 0.4%CVE-2026-92159MEDIUMF´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetryEPSS 0.4%CVE-2025-30651HIGHJunos OS and Junos OS Evolved: Receipt of a specific ICMPv6 packet causes a memory overrun leading to an rpd crashEPSS 0.4%CVE-2026-41035HIGHIn rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. TEPSS 0.4%CVE-2025-20360MEDIUMMultiple Cisco Products Snort 3 MIME Denial of Service VulnerabilityEPSS 0.4%CVE-2026-0716MEDIUMLibsoup: out-of-bounds read in libsoup websocket frame processingEPSS 0.4%CVE-2025-63547HIGHAn issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a crafted packet to the MTU lengEPSS 0.4%CVE-2026-12549MEDIUMLibsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserverEPSS 0.4%CVE-2021-3581HIGHBuffer Access with Incorrect Length Value in zephyrEPSS 0.3%CVE-2025-21591HIGHJunos OS: An unauthenticated adjacent attacker sending a malformed DHCP packet causes jdhcpd to crashEPSS 0.3%CVE-2026-6695MEDIUMGimp: gimp: remote code execution via crafted paa fileEPSS 0.3%CVE-2024-20294MEDIUMA vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthentEPSS 0.3%CVE-2026-1837HIGHlibjxl: Out-of-bounds write in grayscale color transformation when using LCMS2EPSS 0.3%CVE-2026-31607CRITICALusbip: validate number_of_packets in usbip_pack_ret_submit()EPSS 0.3%CVE-2019-19339MEDIUMIt was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the EPSS 0.3%CVE-2026-20290MEDIUMCisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service VulnerabilityEPSS 0.3%