Fallos del tipo CWE-825

100 resultados

Violação de segurança de memória

É a categoria guarda-chuva para falhas que permitem acesso, modificação ou liberação incorreta de memória: buffer overflow, use-after-free, double-free, null pointer dereference, entre outras. O risco é crítico porque o atacante pode executar código arbitrário, vazar dados sensíveis ou travar a aplicação.

Ejemplo

Um programa em C lê dados de rede em um buffer fixo sem validar o tamanho, permitindo que um atacante envie uma carga maior que a capacidade e sobrescreva a pilha — incluindo endereços de retorno — para executar seu próprio código.

Cómo mitigar

Use linguagens memory-safe (Python, Go, Java) ou, em C/C++, valide rigorosamente entrada, use ferramentas como AddressSanitizer e Valgrind, implemente ASLR e DEP no sistema, e revise código com foco em manipulação de ponteiros e alocação dinâmica.

CVE-2026-52924CRITICALsctp: purge outqueue on stale COOKIE-ECHO handlingEPSS 0.7%CVE-2024-39792HIGHNGINX Plus MQTT vulnerabilityEPSS 0.6%CVE-2026-32873HIGHewe: Loop with Unreachable Exit Condition ('Infinite Loop')EPSS 0.6%CVE-2026-53918HIGHodhcpd DHCPv6 IA dangling first pointer use-after-freeEPSS 0.6%CVE-2025-49795HIGHLibxml: null pointer dereference leads to denial of service (dos)EPSS 0.6%CVE-2026-6100CRITICALUse-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressureEPSS 0.6%CVE-2026-4688CRITICALSandbox escape due to use-after-free in the Disability Access APIs componentEPSS 0.6%CVE-2026-58592HIGHLadybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM IntegrationEPSS 0.5%CVE-2026-4691CRITICALUse-after-free in the CSS Parsing and Computation componentEPSS 0.5%CVE-2026-8390HIGHUse-after-free in the JavaScript: WebAssembly componentEPSS 0.5%CVE-2026-12328HIGHMemory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152EPSS 0.5%CVE-2026-78123MEDIUMstrongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin.EPSS 0.5%CVE-2026-57435LOWNokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`EPSS 0.5%CVE-2026-2436MEDIUMLibsoup: libsoup: denial of service via use-after-free in soupserver during tls handshakeEPSS 0.5%CVE-2026-34774HIGHElectron: Use-after-free in offscreen child window paint callbackEPSS 0.5%CVE-2024-28889MEDIUM BIG-IP SSL vulnerabilityEPSS 0.4%CVE-2026-4721CRITICALMemory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149EPSS 0.4%CVE-2026-44422HIGHFreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusionEPSS 0.4%CVE-2026-65970MEDIUMOpenImageIO: TIFF multithreaded scanline read use-after-scope in `TIFFInput::read_native_scanlines`EPSS 0.4%CVE-2026-77220HIGHPDFio < 1.6.5 Dangling Pointer via Dictionary String-FormattingEPSS 0.4%