Fallos del tipo CWE-822

308 resultados

Desreferência de ponteiro não validado

O código desreferenceia um ponteiro (acessa o valor apontado) sem validar se ele é válido ou confiável. Um atacante pode fornecer um endereço de memória malformado ou controlado, causando crash, corrupção de dados ou execução de código arbitrário.

Ejemplo

Um programa recebe um endereço de memória de uma entrada externa (arquivo, rede, argumento do usuário) e imediatamente o usa como ponteiro sem verificar se o endereço é seguro ou se aponta para memória alocada válida. Resultado: acesso a memória inválida.

Cómo mitigar

Sempre validar ponteiros antes de desreferenciar — verificar null, confirmar que apontam para memória alocada pelo programa e, se possível, usar estruturas seguras (smart pointers em C++, bounds checking em C). Evitar aceitar ponteiros diretos de entrada não confiável; prefira índices ou offsets que sejam validados.

CVE-2026-64286HIGHKVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPUEPSS 0.2%CVE-2024-34023MEDIUMUntrusted pointer dereference in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privilegEPSS 0.2%CVE-2026-16511HIGHUnvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memoryEPSS 0.2%CVE-2026-75432MEDIUMAn issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and ScannEPSS 0.2%CVE-2026-19023MEDIUMHDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String DatasetsEPSS 0.2%CVE-2026-15029HIGHUntrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local aEPSS 0.2%CVE-2024-27353HIGHA memory corruption vulnerability in SdHost and SdMmcDevice in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernEPSS 0.2%CVE-2026-18840HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.2%CVE-2024-21455HIGHUntrusted Pointer Dereference in DSP ServiceEPSS 0.2%CVE-2023-42772HIGHUntrusted pointer dereference in UEFI firmware for some Intel(R) reference processors may allow a privileged user to potentially enable escaEPSS 0.2%CVE-2026-19185HIGHUnvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user modeEPSS 0.2%CVE-2026-19442HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.2%CVE-2021-26410LOWImproper syscall input validation in ASP (AMD Secure Processor) may force the kernel into reading syscall parameter values from its own memoEPSS 0.2%CVE-2026-12364HIGHMissing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of serviceEPSS 0.2%CVE-2025-20018MEDIUMUntrusted pointer dereference for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privileEPSS 0.2%CVE-2024-40872HIGHElevation of privilege in Absolute Secure Access clients and serversEPSS 0.2%CVE-2026-8917HIGHUntrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to wrEPSS 0.2%CVE-2024-25078HIGHA memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IBEPSS 0.1%CVE-2024-12576MEDIUMGPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned addressEPSS 0.1%CVE-2026-82927MEDIUMUntrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 06EPSS 0.1%