Fallos del tipo CWE-805

62 resultados

Acesso a buffer com valor de comprimento incorreto

O código acessa um buffer usando um valor de comprimento que não corresponde ao tamanho real alocado, permitindo leitura ou escrita além dos limites. Isso ocorre quando há desajuste entre o tamanho declarado e o tamanho efetivo do buffer, causando corrupção de memória ou exposição de dados sensíveis.

Ejemplo

Um programa aloca 256 bytes para um buffer, mas usa uma variável com valor 512 em uma operação de cópia ou leitura, acessando 256 bytes além do permitido. Ou ainda: uma função recebe um parâmetro de tamanho fornecido pelo usuário sem validar se é compatível com o buffer alocado.

Cómo mitigar

Sempre validar que o comprimento fornecido (seja de entrada, parâmetro ou fonte externa) não ultrapassa o tamanho real do buffer antes de qualquer operação. Use funções seguras que exigem o tamanho explícito (como strncpy em vez de strcpy) e mantenha invariantes claros entre alocação e uso.

CVE-2020-10774—A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl subsystem when reading the /proc/sys/kEPSS 0.3%CVE-2021-48019MEDIUMVyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to ProxiesEPSS 0.2%CVE-2026-1767MEDIUMLocalsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tagsEPSS 0.2%CVE-2025-20191HIGHMultiple Cisco Products Denial of Service VulnerabilityEPSS 0.2%CVE-2025-20202HIGHA vulnerability in Cisco IOS XE Wireless Controller Software could allow an unauthenticated, adjacent attacker to cause a denial of service EPSS 0.2%CVE-2024-3933MEDIUMEclipse Open J9 With -Xgc:concurrentScavenge on IBM Z, could write/read outside of a bufferEPSS 0.2%CVE-2026-15028LOWLibarchive: heap overflow oob read while parsing a tar archive contains a pax extended headerEPSS 0.2%CVE-2024-0131MEDIUMNVIDIA GPU kernel driver for Windows and Linux contains a vulnerability where a potential user-mode attacker could read  a buffer with an inEPSS 0.2%CVE-2022-34399MEDIUM Dell Alienware m17 R5 BIOS version prior to 1.2.2 contain a buffer access vulnerability. A malicious user with admin privileges could potenEPSS 0.2%CVE-2026-20010HIGHCisco Nexus 3000 and 9000 Series Switches Link Layer Discovery Protocol Denial of Service VulnerabilityEPSS 0.2%CVE-2025-7048MEDIUMOn affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these packets with certain MACsec configurations can cause longer term disruption oEPSS 0.2%CVE-2026-20033HIGHCisco NX-OS Software Denial of Service VulnerabilityEPSS 0.2%CVE-2025-36460HIGHDell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerabilityEPSS 0.2%CVE-2025-36463HIGHDell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerabilityEPSS 0.2%CVE-2026-1766MEDIUMLocalsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and information disclosure via malformed mp3 files.EPSS 0.2%CVE-2025-38743HIGHDell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains a Buffer Access with Incorrect Length Value vulnerability. A low privilEPSS 0.1%CVE-2025-36462HIGHDell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerabilityEPSS 0.1%CVE-2025-36461HIGHDell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerabilityEPSS 0.1%CVE-2026-53016HIGHcrypto: ccp - copy IV using skcipher ivsizeEPSS 0.1%CVE-2026-6245MEDIUMSssd: out-of-bounds read in the sssdEPSS 0.1%