Falhas do tipo CWE-119

3.496 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2020-3198CRITICALCisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution VulnerabilitiesEPSS 4.6%CVE-2025-10443HIGHTenda AC9/AC15 exeCommand formexeCommand buffer overflowEPSS 4.6%CVE-2025-10773HIGHB-Link BL-AC2100 Web Management set_delshrpath_cfg delshrpath stack-based overflowEPSS 4.6%CVE-2021-31979HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 4.5%KEVCVE-2025-10385HIGHMercury KM08-708H GiGA WiFi Wave2 mcr_setSysAdm sub_450B2C buffer overflowEPSS 4.5%CVE-2019-6824—A CWE-119: Buffer Errors vulnerability exists in ProClima (all versions prior to version 8.0.0) which allows an unauthenticated, remote attaEPSS 4.5%CVE-2025-6436HIGHMemory safety bugs fixed in Firefox 140 and Thunderbird 140EPSS 4.3%CVE-2025-13445HIGHTenda AC21 SetIpMacBind stack-based overflowEPSS 4.2%CVE-2025-13446HIGHTenda AC21 SetSysTimeCfg stack-based overflowEPSS 4.2%CVE-2017-7506—spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages from authenticated attacEPSS 4.2%CVE-2020-17003HIGHBase3D Remote Code Execution VulnerabilityEPSS 4.2%CVE-2025-11120HIGHTenda AC8 SetServerConfig formSetServerConfig buffer overflowEPSS 4.2%CVE-2026-7857HIGHD-Link DI-8100 CGI user_group.asp sprintf buffer overflowEPSS 4.2%CVE-2019-12806—UniSign 2.0.4.0 and earlier version contains a stack-based buffer overflow vulnerability which can overwrite the stack with arbitrary data, EPSS 4.1%CVE-2019-11933—A heap buffer overflow bug in libpl_droidsonroids_gif before 1.2.19, as used in WhatsApp for Android before version 2.19.291 could allow remEPSS 4.1%CVE-2016-1421—A vulnerability in the web application for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileEPSS 4.1%CVE-2026-0840HIGHUTT 进取 520W formConfigNoticeConfig strcpy buffer overflowEPSS 4.1%CVE-2026-7851HIGHD-Link DI-8100 yyxz.asp sprintf stack-based overflowEPSS 4.1%CVE-2017-15126—A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure EPSS 4.1%CVE-2019-15992HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Code Execution VulnerabilityEPSS 4.1%