Falhas do tipo CWE-119

3.268 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2026-64698CRITICALThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. AEPSS 0.6%CVE-2026-13588MEDIUMseladb PcapPlusPlus TLS Hello SSLHandshake.cpp getHandshakeVersion heap-based overflowEPSS 0.6%CVE-2026-96257CRITICALFast FAC1203R Gigabit Edition Device Discovery Service copy_msg_element stack-based overflowEPSS 0.6%CVE-2024-7972HIGHInappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially perform out of bounds meEPSS 0.6%CVE-2024-8387CRITICALMemory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruptionEPSS 0.6%CVE-2026-2779CRITICALIncorrect boundary conditions in the Networking: JAR componentEPSS 0.6%CVE-2026-12174HIGHD-Link DCS-935L HTTP rhea snprintf format stringEPSS 0.6%CVE-2025-29366CRITICALIn mupen64plus v2.6.0 there is an array overflow vulnerability in the write_rdram_regs and write_rdram_regs functions, which enables executiEPSS 0.6%CVE-2022-1115—A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulnerability is triggered EPSS 0.6%CVE-2017-7407LOWThe ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from pEPSS 0.6%CVE-2025-3406MEDIUMNothings stb Header Array stbhw_build_tileset_from_image out-of-boundsEPSS 0.6%CVE-2019-15249HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15241HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15248HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15247HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15246HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15240HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15252HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15244HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15251HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%