Falhas do tipo CWE-119

3.268 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2026-94003CRITICALComfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflowEPSS 0.6%CVE-2026-7320HIGHInformation disclosure due to incorrect boundary conditions in the Audio/Video componentEPSS 0.6%CVE-2020-10061HIGHError handling invalid packet sequenceEPSS 0.6%CVE-2026-8946HIGHIncorrect boundary conditions in the Audio/Video: Web Codecs componentEPSS 0.6%CVE-2024-30398HIGHJunos OS: SRX4600 Series - A high amount of specific traffic causes packet drops and an eventual PFE crashEPSS 0.6%CVE-2026-87931CRITICALBehavioral Technology Group Pavlok Behavioral Conditioning Wearable Apple Notification Center Service Event buffer overflowEPSS 0.6%CVE-2024-23132HIGHMultiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareEPSS 0.6%CVE-2026-11517HIGHUTT HiPER 2610G formConfigDnsFilterGlobal strcpy buffer overflowEPSS 0.6%CVE-2020-12031HIGHRockwell Automation FactoryTalk View SEEPSS 0.6%CVE-2022-3784MEDIUMAxiomatic Bento4 mp4hls Ap4Mp4AudioInfo.cpp ReadBits heap-based overflowEPSS 0.6%CVE-2026-19341HIGHUTT HiPER 1200GW pptpSrvGlobalConfig strcpy stack-based overflowEPSS 0.6%CVE-2026-75783CRITICALTRENDnet TEW-WLC100P DHCP blobmsg netifd stack-based overflowEPSS 0.6%CVE-2022-41189HIGHDue to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dwg, TeighaTranslator.exe) file received from untrustedEPSS 0.6%CVE-2022-41200—Due to lack of proper memory management, when a victim opens a manipulated Scalable Vector Graphic (.svg, svg.x3d) file received from untrusEPSS 0.6%CVE-2025-26781HIGHAn issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330,EPSS 0.6%CVE-2022-41202HIGHDue to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, vds.x3d) file received from untrustedEPSS 0.6%CVE-2022-41198—Due to lack of proper memory management, when a victim opens a manipulated SketchUp (.skp, SketchUp.x3d) file received from untrusted sourceEPSS 0.6%CVE-2020-14345—A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escaEPSS 0.6%CVE-2026-2181HIGHTenda RX3 openSchedWifi stack-based overflowEPSS 0.6%CVE-2025-1182LOWGNU Binutils ld elflink.c bfd_elf_reloc_symbol_deleted_p memory corruptionEPSS 0.6%