Fallos del tipo CWE-822

308 resultados

Desreferência de ponteiro não validado

O código desreferenceia um ponteiro (acessa o valor apontado) sem validar se ele é válido ou confiável. Um atacante pode fornecer um endereço de memória malformado ou controlado, causando crash, corrupção de dados ou execução de código arbitrário.

Ejemplo

Um programa recebe um endereço de memória de uma entrada externa (arquivo, rede, argumento do usuário) e imediatamente o usa como ponteiro sem verificar se o endereço é seguro ou se aponta para memória alocada válida. Resultado: acesso a memória inválida.

Cómo mitigar

Sempre validar ponteiros antes de desreferenciar — verificar null, confirmar que apontam para memória alocada pelo programa e, se possível, usar estruturas seguras (smart pointers em C++, bounds checking em C). Evitar aceitar ponteiros diretos de entrada não confiável; prefira índices ou offsets que sejam validados.

CVE-2026-82927MEDIUMUntrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 06EPSS 0.1%CVE-2025-27710MEDIUMUntrusted pointer dereference for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an infEPSS 0.1%CVE-2026-115653HIGHCortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged modeEPSS 0.1%CVE-2026-19595MEDIUMZephyr RTIO syscall verifier validates output parameters for read instead of write accessEPSS 0.1%CVE-2025-20090MEDIUMUntrusted Pointer Dereference for some Intel(R) QuickAssist Technology software before version 2.5.0 may allow an authenticated user to poteEPSS 0.1%CVE-2025-59959MEDIUMJunos OS and Junos OS Evolved: Executing a specific show command leads to an rpd crashEPSS 0.1%CVE-2026-9771HIGHMissing device-pointer validation in flash_copy() syscall allows userspace privilege escalationEPSS 0.1%CVE-2026-113780CRITICALESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch BoundaryEPSS 0.1%CVE-2026-90890MEDIUMASRock｜ASRock Polychrome SYNC/RGB software utility - Untrusted Pointer DereferenceEPSS 0.1%CVE-2024-36352HIGHImproper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to aEPSS 0.1%CVE-2025-52516MEDIUMAn issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. An invalEPSS 0.1%CVE-2026-33964MEDIUMAn issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500. An untrusted pointer dereference occurs when a malformedEPSS 0.1%CVE-2025-32446MEDIUMUntrusted pointer dereference for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allowEPSS 0.1%CVE-2026-91795HIGHFoxit PDF Editor/Reader FileOpen Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.1%CVE-2024-53033HIGHUntrusted Pointer Dereference in DSP_ServicesEPSS 0.1%CVE-2024-53034HIGHUntrusted Pointer Dereference in DSP_ServicesEPSS 0.1%CVE-2026-97876MEDIUMBypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base addressEPSS 0.1%CVE-2026-110322MEDIUMHMS Networks PEAK-System PCAN Windows drivers Untrusted Pointer DereferenceEPSS 0.1%CVE-2026-87041HIGHInverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memoryEPSS 0.1%CVE-2026-88781MEDIUMUntrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory addEPSS 0.1%