Falhas do tipo CWE-119

3.507 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2024-22391HIGHA heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A spEPSS 1.4%CVE-2026-7069HIGHD-Link DIR-825 miniupnpd upnpsoap.c AddPortMapping buffer overflowEPSS 1.4%CVE-2024-45169CRITICALAn issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and iEPSS 1.4%CVE-2019-13522—An attacker could use a specially crafted project file to corrupt the memory and execute code under the privileges of the EZ PLC Editor VersEPSS 1.4%CVE-2024-20082CRITICALIn Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote code execution with no additional eEPSS 1.4%CVE-2025-5799HIGHTenda AC8 WifiExtraSet fromSetWirelessRepeat stack-based overflowEPSS 1.4%CVE-2025-5798HIGHTenda AC8 SetSysTimeCfg fromSetSysTime stack-based overflowEPSS 1.4%CVE-2025-1153LOWGNU Binutils format.c bfd_set_format memory corruptionEPSS 1.4%CVE-2021-27397—A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validEPSS 1.4%CVE-2025-7085HIGHBelkin F9K1122 webs formiNICWpsStart stack-based overflowEPSS 1.4%CVE-2026-120189CRITICALD-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflowEPSS 1.3%CVE-2025-9089HIGHTenda AC20 SetIpMacBind sub_48E628 stack-based overflowEPSS 1.3%CVE-2020-25690—An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens.EPSS 1.3%CVE-2025-5600CRITICALTOTOLINK EX1200T cstecgi.cgi setLanguageCfg stack-based overflowEPSS 1.3%CVE-2025-11294HIGHBelkin F9K1015 formL2TPSetup buffer overflowEPSS 1.3%CVE-2022-30938—A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versEPSS 1.3%CVE-2025-6146HIGHTOTOLINK X15 HTTP POST Request formSysLog buffer overflowEPSS 1.3%CVE-2025-4843HIGHD-Link DCS-932L udev SubUPnPCSInit stack-based overflowEPSS 1.3%CVE-2025-4841HIGHD-Link DCS-932L gpio sub_404780 stack-based overflowEPSS 1.3%CVE-2025-4842HIGHD-Link DCS-932L ucp isUCPCameraNameChanged stack-based overflowEPSS 1.3%