Falhas do tipo CWE-119

3.506 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2021-3498—GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.EPSS 1.8%CVE-2024-0532HIGHTenda A15 Web-based Management Interface WifiExtraSet set_repeat5 stack-based overflowEPSS 1.8%CVE-2024-11960HIGHD-Link DIR-605L formSetPortTr buffer overflowEPSS 1.8%CVE-2024-11959HIGHD-Link DIR-605L formResetStatistic buffer overflowEPSS 1.8%CVE-2025-7544HIGHTenda AC1206 setMacFilterCfg formSetMacFilterCfg stack-based overflowEPSS 1.8%CVE-2017-6745—A vulnerability in the cache server within Cisco Videoscape Distribution Suite (VDS) for Television 3.2(5)ES1 could allow an unauthenticatedEPSS 1.7%CVE-2025-7910HIGHD-Link DIR-513 Boa Webserver formSetWanNonLogin sprintf stack-based overflowEPSS 1.7%CVE-2025-7909HIGHD-Link DIR-513 Boa Webserver formLanSetupRouterSettings sprintf stack-based overflowEPSS 1.7%CVE-2025-4871MEDIUMPCMan FTP Server REST Command buffer overflowEPSS 1.7%CVE-2021-40117HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Denial of Service VulnerabilityEPSS 1.7%CVE-2025-4148HIGHNetgear EX6200 sub_503FC buffer overflowEPSS 1.7%CVE-2025-4149HIGHNetgear EX6200 sub_54014 buffer overflowEPSS 1.7%CVE-2018-0103—A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a local attackEPSS 1.7%CVE-2019-1772HIGHCisco Webex Network Recording Player Arbitrary Code Execution VulnerabilityEPSS 1.7%CVE-2019-1773HIGHCisco Webex Network Recording Player Arbitrary Code Execution VulnerabilitiesEPSS 1.7%CVE-2019-3561—Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported versionEPSS 1.7%CVE-2020-13496MEDIUMAn exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file EPSS 1.7%CVE-2021-44016—A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (AlEPSS 1.7%CVE-2021-32994HIGHSofting OPC-UA C++ SDK Improper Restriction of Operations within the Bounds of a Memory BufferEPSS 1.7%CVE-2025-7908HIGHD-Link DI-8100 jhttpd ddns.asp sprintf stack-based overflowEPSS 1.7%