Falhas do tipo CWE-119

3.263 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2026-7857HIGHD-Link DI-8100 CGI user_group.asp sprintf buffer overflowEPSS 4.2%CVE-2019-12806—UniSign 2.0.4.0 and earlier version contains a stack-based buffer overflow vulnerability which can overwrite the stack with arbitrary data, EPSS 4.1%CVE-2019-15992HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Code Execution VulnerabilityEPSS 4.1%CVE-2019-11933—A heap buffer overflow bug in libpl_droidsonroids_gif before 1.2.19, as used in WhatsApp for Android before version 2.19.291 could allow remEPSS 4.1%CVE-2016-1421—A vulnerability in the web application for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileEPSS 4.1%CVE-2026-0840HIGHUTT 进取 520W formConfigNoticeConfig strcpy buffer overflowEPSS 4.1%CVE-2026-7851HIGHD-Link DI-8100 yyxz.asp sprintf stack-based overflowEPSS 4.1%CVE-2022-3435MEDIUMLinux Kernel IPv4 fib_semantics.c fib_nh_match out-of-boundsEPSS 4.1%CVE-2017-15126—A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure EPSS 4.1%CVE-2025-10773HIGHB-Link BL-AC2100 Web Management set_delshrpath_cfg delshrpath stack-based overflowEPSS 4.0%CVE-2019-11929—Insufficient boundary checks when formatting numbers in number_format allows read/write access to out-of-bounds memory, potentially leading EPSS 4.0%CVE-2022-3559MEDIUMExim Regex use after freeEPSS 4.0%CVE-2025-10443HIGHTenda AC9/AC15 exeCommand formexeCommand buffer overflowEPSS 4.0%CVE-2025-15356HIGHTenda AC20 PowerSaveSet sscanf buffer overflowEPSS 4.0%CVE-2018-10873HIGHA vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bouEPSS 3.9%CVE-2025-9363HIGHLinksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 portTriggerManageRule stack-based overflowEPSS 3.9%CVE-2020-3375CRITICALCisco SD-WAN Solution Software Buffer Overflow VulnerabilityEPSS 3.9%CVE-2025-13445HIGHTenda AC21 SetIpMacBind stack-based overflowEPSS 3.9%CVE-2025-13446HIGHTenda AC21 SetSysTimeCfg stack-based overflowEPSS 3.9%CVE-2017-1000101MEDIUMcurl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence ofEPSS 3.9%