Falhas do tipo CWE-119

3.268 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2026-2522MEDIUMOpen5GS MME esm-build.c memory corruptionEPSS 0.6%CVE-2017-12282—A vulnerability in the Access Network Query Protocol (ANQP) ingress frame processing functionality of Cisco Wireless LAN Controllers could aEPSS 0.6%CVE-2025-9179CRITICALSandbox escape due to invalid pointer in the Audio/Video: GMP componentEPSS 0.6%CVE-2025-1179LOWGNU Binutils ld libbfd.c bfd_putl64 memory corruptionEPSS 0.6%CVE-2025-2368MEDIUMWebAssembly wabt Malformed File binary-reader-interp.cc OnExport heap-based overflowEPSS 0.6%CVE-2017-14202—The shell implementation does not protect against buffer overruns resulting in unpredictable behavior.EPSS 0.6%CVE-2025-31223HIGHThe issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, vEPSS 0.6%CVE-2021-4008—A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcRenderComposEPSS 0.6%CVE-2021-4011—A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SwapCreateRegisteEPSS 0.6%CVE-2021-3410—A flaw was found in libcaca v0.99.beta19. A buffer overflow issue in caca_resize function in libcaca/caca/canvas.c may lead to local executiEPSS 0.6%CVE-2025-31234HIGHThe issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, viEPSS 0.6%CVE-2022-39806—Due to lack of proper memory management, when a victim opens a manipulated SolidWorks Drawing (.slddrw, CoreCadTranslator.exe) file receivedEPSS 0.6%CVE-2022-3349MEDIUMSony PS4/PS5 exFAT UVFAT_readupcasetable heap-based overflowEPSS 0.6%CVE-2026-78156MEDIUMOpen5GS S6a Authentication-Information-Request hss-s6a-path.c hss_ogs_diam_s6a_air_cb heap-based overflowEPSS 0.6%CVE-2024-8534HIGHMemory safety vulnerability leading to memory corruption and Denial of ServiceEPSS 0.6%CVE-2022-42529CRITICALProduct: AndroidVersions: Android kernelAndroid ID: A-235292841References: N/AEPSS 0.6%CVE-2025-31246HIGHThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6. Connecting to a malicEPSS 0.6%CVE-2022-39804—Due to lack of proper memory management, when a victim opens a manipulated SolidWorks Part (.sldprt, CoreCadTranslator.exe) file received frEPSS 0.6%CVE-2022-39803—Due to lack of proper memory management, when a victim opens a manipulated ACIS Part and Assembly (.sat, CoreCadTranslator.exe) file receiveEPSS 0.6%CVE-2026-8391MEDIUMOther issue in the JavaScript Engine componentEPSS 0.6%