Fallos del tipo CWE-822

248 resultados

Desreferência de ponteiro não validado

O código desreferenceia um ponteiro (acessa o valor apontado) sem validar se ele é válido ou confiável. Um atacante pode fornecer um endereço de memória malformado ou controlado, causando crash, corrupção de dados ou execução de código arbitrário.

Ejemplo

Um programa recebe um endereço de memória de uma entrada externa (arquivo, rede, argumento do usuário) e imediatamente o usa como ponteiro sem verificar se o endereço é seguro ou se aponta para memória alocada válida. Resultado: acesso a memória inválida.

Cómo mitigar

Sempre validar ponteiros antes de desreferenciar — verificar null, confirmar que apontam para memória alocada pelo programa e, se possível, usar estruturas seguras (smart pointers em C++, bounds checking em C). Evitar aceitar ponteiros diretos de entrada não confiável; prefira índices ou offsets que sejam validados.

CVE-2024-40872HIGHElevation of privilege in Absolute Secure Access clients and serversEPSS 0.2%CVE-2025-20018MEDIUMUntrusted pointer dereference for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privileEPSS 0.2%CVE-2021-26410LOWImproper syscall input validation in ASP (AMD Secure Processor) may force the kernel into reading syscall parameter values from its own memoEPSS 0.2%CVE-2024-25078HIGHA memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IBEPSS 0.1%CVE-2025-59959MEDIUMJunos OS and Junos OS Evolved: Executing a specific show command leads to an rpd crashEPSS 0.1%CVE-2024-12576MEDIUMGPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned addressEPSS 0.1%CVE-2025-20090MEDIUMUntrusted Pointer Dereference for some Intel(R) QuickAssist Technology software before version 2.5.0 may allow an authenticated user to poteEPSS 0.1%CVE-2025-27710MEDIUMUntrusted pointer dereference for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an infEPSS 0.1%CVE-2026-7406HIGHBMP File Parsing Untrusted Pointer Dereference in certain Autodesk productsEPSS 0.1%CVE-2024-36352HIGHImproper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to aEPSS 0.1%CVE-2025-52516MEDIUMAn issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. An invalEPSS 0.1%CVE-2026-18840HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2026-94403CRITICALColorFul iGameCenter IOCTL ene.sys sub_140001AF0 untrusted pointer dereferenceEPSS 0.1%CVE-2026-19442HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2026-45198HIGHGPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrustedEPSS 0.1%CVE-2026-12364HIGHMissing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of serviceEPSS 0.1%CVE-2025-32446MEDIUMUntrusted pointer dereference for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allowEPSS 0.1%CVE-2026-19023MEDIUMHDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String DatasetsEPSS 0.1%CVE-2024-53033HIGHUntrusted Pointer Dereference in DSP_ServicesEPSS 0.1%CVE-2024-53034HIGHUntrusted Pointer Dereference in DSP_ServicesEPSS 0.1%