Falhas do tipo CWE-119

3.506 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2025-9938HIGHD-Link DI-8400 yyxz.asp yyxz_dlink_asp stack-based overflowEPSS 1.7%CVE-2024-3832HIGHObject corruption in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a craEPSS 1.7%CVE-2025-31277HIGHThe issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOEPSS 1.7%KEVCVE-2021-1278HIGHCisco SD-WAN Denial of Service VulnerabilitiesEPSS 1.7%CVE-2017-12359—A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (.arf) files could allow an attacker tEPSS 1.7%CVE-2023-28379CRITICALA memory corruption vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially craEPSS 1.7%CVE-2023-31247CRITICALA memory corruption vulnerability exists in the HTTP Server Host header parsing functionality of Weston Embedded uC-HTTP v3.01.01. A specialEPSS 1.7%CVE-2022-3705MEDIUMvim autocmd quickfix.c qf_update_buffer use after freeEPSS 1.7%CVE-2025-4150HIGHNetgear EX6200 sub_54340 buffer overflowEPSS 1.7%CVE-2020-35527—In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.EPSS 1.7%CVE-2024-23617CRITICALSymantec Data Loss Prevention Buffer OverflowEPSS 1.7%CVE-2023-3138—A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values EPSS 1.7%CVE-2026-20700HIGHA memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tEPSS 1.7%KEVCVE-2024-22373HIGHAn out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3EPSS 1.7%CVE-2026-34159CRITICALllama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 bypass in llama.cpp RPC backendEPSS 1.6%CVE-2019-12807—Alzip 10.83 and earlier version contains a stack-based buffer overflow vulnerability, caused by improper bounds checking during the parsing EPSS 1.6%CVE-2020-3500MEDIUMCisco StarOS IPv6 Denial of Service VulnerabilityEPSS 1.6%CVE-2025-35003CRITICALApache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities.EPSS 1.6%CVE-2021-34783HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Software-Based SSL/TLS Denial of Service VulnerabilityEPSS 1.6%CVE-2020-11058LOWImproper Restriction of Operations within the Bounds of a Memory Buffer in FreeRDPEPSS 1.6%