Fallos del tipo CWE-825

86 resultados

Violação de segurança de memória

É a categoria guarda-chuva para falhas que permitem acesso, modificação ou liberação incorreta de memória: buffer overflow, use-after-free, double-free, null pointer dereference, entre outras. O risco é crítico porque o atacante pode executar código arbitrário, vazar dados sensíveis ou travar a aplicação.

Ejemplo

Um programa em C lê dados de rede em um buffer fixo sem validar o tamanho, permitindo que um atacante envie uma carga maior que a capacidade e sobrescreva a pilha — incluindo endereços de retorno — para executar seu próprio código.

Cómo mitigar

Use linguagens memory-safe (Python, Go, Java) ou, em C/C++, valide rigorosamente entrada, use ferramentas como AddressSanitizer e Valgrind, implemente ASLR e DEP no sistema, e revise código com foco em manipulação de ponteiros e alocação dinâmica.

CVE-2024-23638MEDIUMSQUID-2023:11 Denial of Service in Cache ManagerEPSS 60.1%CVE-2026-33526CRITICALSquid vulnerable to Denial of Service in ICP Request handlingEPSS 8.9%CVE-2026-45447HIGHHeap Use-After-Free in the PKCS7_verify() FunctionEPSS 5.2%CVE-2019-15691—TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoderEPSS 4.7%CVE-2023-48316CRITICALAzure RTOS NetX Duo Remote Code Execution VulnerabilityEPSS 4.3%CVE-2023-48315HIGHAzure RTOS NetX Duo Remote Code Execution VulnerabilityEPSS 3.9%CVE-2023-48692CRITICALAzure RTOS NetX Duo Remote Code Execution VulnerabilityEPSS 3.1%CVE-2023-20212HIGHA vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition EPSS 2.6%CVE-2024-23310CRITICALA use-after-free vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee11EPSS 1.7%CVE-2026-3593HIGHHeap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementationEPSS 1.5%CVE-2021-39228MEDIUMMemory Safety Issue when using patch or merge on state and assign the result back to stateEPSS 1.3%CVE-2023-48694MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 1.3%CVE-2023-48697MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 1.2%CVE-2023-48696MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-48698MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-6722CRITICALUse-After-Free in SOAP using Apache mapEPSS 0.9%CVE-2025-49794CRITICALLibxml: heap use after free (uaf) leads to denial of service (dos)EPSS 0.7%CVE-2024-39792HIGHNGINX Plus MQTT vulnerabilityEPSS 0.6%CVE-2026-24678HIGHFreeRDP has a Heap-use-after-free in cam_v4l_stream_capture_threadEPSS 0.6%CVE-2026-32873HIGHewe: Loop with Unreachable Exit Condition ('Infinite Loop')EPSS 0.6%