Fallos del tipo CWE-822

248 resultados

Desreferência de ponteiro não validado

O código desreferenceia um ponteiro (acessa o valor apontado) sem validar se ele é válido ou confiável. Um atacante pode fornecer um endereço de memória malformado ou controlado, causando crash, corrupção de dados ou execução de código arbitrário.

Ejemplo

Um programa recebe um endereço de memória de uma entrada externa (arquivo, rede, argumento do usuário) e imediatamente o usa como ponteiro sem verificar se o endereço é seguro ou se aponta para memória alocada válida. Resultado: acesso a memória inválida.

Cómo mitigar

Sempre validar ponteiros antes de desreferenciar — verificar null, confirmar que apontam para memória alocada pelo programa e, se possível, usar estruturas seguras (smart pointers em C++, bounds checking em C). Evitar aceitar ponteiros diretos de entrada não confiável; prefira índices ou offsets que sejam validados.

CVE-2021-31500HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2024-37969HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 1.4%CVE-2025-62549HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.3%CVE-2020-27288—An untrusted pointer dereference has been identified in the way TPEditor(v1.98 and prior) processes project files, allowing an attacker to cEPSS 1.3%CVE-2020-1899—The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arEPSS 1.2%CVE-2026-50424HIGHWindows Domain Controller Denial of Service VulnerabilityEPSS 1.2%CVE-2025-21381HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 1.1%CVE-2018-12548—In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives whichEPSS 1.1%CVE-2024-38187HIGHWindows Kernel-Mode Driver Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2024-38185HIGHWindows Kernel-Mode Driver Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2026-21250HIGHWindows HTTP.sys Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2024-49090HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2020-26997—A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2020 (All versions < SE2020MP14), Solid EEPSS 1.0%CVE-2023-36045HIGHMicrosoft Office Graphics Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-21354HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-72956MEDIUMMicrosoft Office PowerPoint Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-72938MEDIUMMicrosoft Office PowerPoint Information Disclosure VulnerabilityEPSS 0.9%CVE-2021-38401HIGHFuji Electric Tellus Lite V-Simulator untrusted pointer dereferenceEPSS 0.9%CVE-2025-29812HIGHDirectX Graphics Kernel Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2022-22514HIGHUntrusted Pointer Dereference in multiple CODESYS products can lead to a DoS.EPSS 0.9%