Falhas do tipo CWE-119

3.503 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2025-5623CRITICALD-Link DIR-816 qosClassifier stack-based overflowEPSS 19.5%CVE-2024-0088MEDIUMCVEEPSS 18.9%CVE-2017-0022MEDIUMMicrosoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 EPSS 18.1%KEVCVE-2025-1340HIGHTOTOLINK X18 cstecgi.cgi setPasswordCfg stack-based overflowEPSS 16.7%CVE-2025-5548MEDIUMFreeFloat FTP Server NOOP Command buffer overflowEPSS 15.9%CVE-2025-8184HIGHD-Link DIR-513 HTTP POST Request formSetWanL2TPtriggers formSetWanL2TPcallback stack-based overflowEPSS 15.4%CVE-2014-3478MEDIUMBuffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.EPSS 15.2%CVE-2017-3807—A vulnerability in Common Internet Filesystem (CIFS) code in the Clientless SSL VPN functionality of Cisco ASA Software, Major Releases 9.0-EPSS 14.8%CVE-2018-0151CRITICALA vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, reEPSS 14.2%KEVCVE-2018-4404HIGHIn iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improved memory handling.EPSS 14.0%CVE-2025-7088HIGHBelkin F9K1122 webs formPPPoESetup stack-based overflowEPSS 13.8%CVE-2025-7087HIGHBelkin F9K1122 webs formL2TPSetup stack-based overflowEPSS 13.4%CVE-2017-16368HIGHAn issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.3035EPSS 13.2%CVE-2025-8017HIGHTenda AC7 httpd setMacFilterCfg formSetMacFilterCfg stack-based overflowEPSS 13.2%CVE-2025-3538HIGHD-Link DI-8100 jhttpd auth.asp auth_asp stack-based overflowEPSS 13.2%CVE-2025-3785HIGHD-Link DWR-M961 Authorization Interface formStaticDHCP stack-based overflowEPSS 12.8%CVE-2025-3820HIGHTenda W12/i24 httpd cgiSysUplinkCheckSet stack-based overflowEPSS 12.7%CVE-2025-5527HIGHTenda RX3 SetStaticRouteCfg save_staticroute_data stack-based overflowEPSS 12.7%CVE-2025-5905HIGHTOTOLINK T10 POST Request cstecgi.cgi setWiFiRepeaterCfg buffer overflowEPSS 12.4%CVE-2025-8180HIGHTenda CH22 deleteUserName formdeleteUserName buffer overflowEPSS 12.3%