Falhas do tipo CWE-119

3.263 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2026-0837HIGHUTT 进取 520W formFireWall strcpy buffer overflowEPSS 3.9%CVE-2026-0841HIGHUTT 进取 520W formPictureUrl strcpy buffer overflowEPSS 3.9%CVE-2026-0838HIGHUTT 进取 520W ConfigWirelessBase strcpy buffer overflowEPSS 3.9%CVE-2022-32839CRITICALThe issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-EPSS 3.8%CVE-2025-10385HIGHMercury KM08-708H GiGA WiFi Wave2 mcr_setSysAdm sub_450B2C buffer overflowEPSS 3.8%CVE-2026-11498HIGHTenda HG7HG9/HG10 Web Management voip_other_set asp_voip_OtherSet stack-based overflowEPSS 3.8%CVE-2022-3964MEDIUMffmpeg QuickTime RPZA Video Encoder rpzaenc.c out-of-boundsEPSS 3.8%CVE-2025-11120HIGHTenda AC8 SetServerConfig formSetServerConfig buffer overflowEPSS 3.7%CVE-2026-4567CRITICALTenda A15 UploadCfg stack-based overflowEPSS 3.7%CVE-2022-26763HIGHAn out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, SecurEPSS 3.7%CVE-2026-1420HIGHTenda AC23 WifiExtraSet buffer overflowEPSS 3.7%CVE-2025-13305HIGHD-Link DWR-M920/DWR-M921/DWR-M960/DIR-822K/DIR-825M formTracerouteDiagnosticRun buffer overflowEPSS 3.6%CVE-2026-2961HIGHD-Link DWR-M960 VPN Configuration Endpoint formVpnConfigSetup sub_4196C4 stack-based overflowEPSS 3.5%CVE-2020-17426HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interacEPSS 3.5%CVE-2026-2962HIGHD-Link DWR-M960 Scheduled Reboot Configuration Endpoint formDateReboot sub_460F30 stack-based overflowEPSS 3.5%CVE-2022-32847CRITICALThis issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6EPSS 3.5%CVE-2025-6436HIGHMemory safety bugs fixed in Firefox 140 and Thunderbird 140EPSS 3.5%CVE-2021-3657—A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or comprEPSS 3.5%CVE-2025-1876MEDIUMD-Link DAP-1562 HTTP Header http_request_parse stack-based overflowEPSS 3.5%CVE-2018-0175HIGHFormat String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOEPSS 3.5%KEV