Falhas do tipo CWE-119

3.268 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2024-30253HIGHHandling untrusted input can result in a crash, leading to loss of availability / denial of serviceEPSS 0.6%CVE-2025-1182LOWGNU Binutils ld elflink.c bfd_elf_reloc_symbol_deleted_p memory corruptionEPSS 0.6%CVE-2026-5317MEDIUMNothings stb stb_vorbis.c start_decoder out-of-bounds writeEPSS 0.6%CVE-2022-41196—Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sourcesEPSS 0.6%CVE-2025-2337MEDIUMtbeu matio mat.c Mat_VarPrint heap-based overflowEPSS 0.6%CVE-2025-7208MEDIUM9fans plan9port x509.c edump heap-based overflowEPSS 0.6%CVE-2025-2151MEDIUMOpen Asset Import Library Assimp File ParsingUtils.h GetNextLine stack-based overflowEPSS 0.6%CVE-2026-2930MEDIUMTenda A18 Httpd Service UploadCfg webCgiGetUploadFile stack-based overflowEPSS 0.6%CVE-2026-92061CRITICALIncorrect boundary conditions in the Security: Process Sandboxing componentEPSS 0.6%CVE-2026-92036CRITICALIncorrect boundary conditions in the Networking: HTTP componentEPSS 0.6%CVE-2026-8975HIGHMemory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151EPSS 0.6%CVE-2024-9396HIGHIt is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to mEPSS 0.6%CVE-2026-92037CRITICALIncorrect boundary conditions in the DOM: Animation componentEPSS 0.6%CVE-2024-8937HIGHCWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitraryEPSS 0.6%CVE-2026-64698CRITICALThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. AEPSS 0.6%CVE-2026-64697CRITICALThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. AEPSS 0.6%CVE-2026-39873CRITICALThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. CEPSS 0.6%CVE-2026-13589MEDIUMseladb PcapPlusPlus Telnet Subnegotiation Packet TelnetLayer.cpp getSubCommand heap-based overflowEPSS 0.6%CVE-2026-13588MEDIUMseladb PcapPlusPlus TLS Hello SSLHandshake.cpp getHandshakeVersion heap-based overflowEPSS 0.6%CVE-2026-43694CRITICALThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. AEPSS 0.6%