Falhas do tipo CWE-119

3.506 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2017-3863—Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow EPSS 2.8%CVE-2021-42782—Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the liEPSS 2.8%CVE-2025-6121CRITICALD-Link DIR-632 HTTP POST Request get_pure_content stack-based overflowEPSS 2.8%CVE-2020-3573HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesEPSS 2.8%CVE-2021-21899HIGHA code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A speEPSS 2.8%CVE-2025-5630CRITICALD-Link DIR-816 form2lansetup.cgi stack-based overflowEPSS 2.7%CVE-2025-4441HIGHD-Link DIR-605L formSetWAN_Wizard534 buffer overflowEPSS 2.7%CVE-2025-4442HIGHD-Link DIR-605L formSetWAN_Wizard55 buffer overflowEPSS 2.7%CVE-2020-15254HIGHUndefined Behavior in bounded Crossbeam channelEPSS 2.7%CVE-2026-3910HIGHInappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandEPSS 2.7%KEVCVE-2020-26243HIGHMemory leak in nanopbEPSS 2.7%CVE-2026-4906HIGHTenda AC5 POST Request WizardHandle decodePwd stack-based overflowEPSS 2.6%CVE-2019-5105HIGHAn exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewaEPSS 2.6%CVE-2020-3603HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesEPSS 2.6%CVE-2025-5622CRITICALD-Link DIR-816 wirelessApcli_5g stack-based overflowEPSS 2.6%CVE-2025-5624CRITICALD-Link DIR-816 QoSPortSetup stack-based overflowEPSS 2.6%CVE-2020-3604HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesEPSS 2.6%CVE-2021-21898HIGHA code execution vulnerability exists in the dwgCompressor::decompress18() functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specEPSS 2.6%CVE-2020-1574MEDIUMMicrosoft Windows Codecs Library Remote Code Execution VulnerabilityEPSS 2.6%CVE-2020-3268HIGHCisco Small Business RV110W, RV130, RV130W, and RV215W Series Routers Management Interface VulnerabilitiesEPSS 2.6%