Falhas do tipo CWE-121

3.839 resultados

Estouro de buffer na pilha

Ocorre quando código escreve mais dados em um buffer alocado na pilha do que sua capacidade permite, sobrescrevendo dados adjacentes (variáveis, endereços de retorno). Um atacante pode explorar isso para executar código arbitrário ou crashar a aplicação alterando o fluxo de execução.

Exemplo

Uma função C que copia uma string do usuário diretamente em um array local sem validar tamanho: `char buffer[10]; strcpy(buffer, user_input);`. Se user_input tiver 50 caracteres, os 40 extras sobrescrevem a pilha, incluindo potencialmente o endereço de retorno da função.

Como mitigar

Use funções seguras que limitam escrita (strncpy, snprintf em vez de strcpy/sprintf), valide tamanho de entrada antes de copiar, ative proteções do compilador (stack canaries, ASLR) e use ferramentas de análise estática para detectar cópias sem limite.

CVE-2025-57085CRITICALTenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function. This vulnerability EPSS 0.5%CVE-2025-25741MEDIUMD-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the IPv6_PppoePassword parameter in thEPSS 0.5%CVE-2023-42069HIGHPDF-XChange Editor PDF File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.5%CVE-2024-32288MEDIUMTenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page parameter in the fromwebExcptypemanFilter fuEPSS 0.5%CVE-2026-86514MEDIUMvgmstream txth-txtp txth.c sscanf stack-based overflowEPSS 0.5%CVE-2014-0774—Schneider Electric OFS Stack Buffer OverflowEPSS 0.5%CVE-2024-46546HIGHNEXTU FLETA AX1500 WIFI6 Router v1.0.3 was discovered to contain a stack overflow via the url parameter at /boafrm/formFilter. This vulnerabEPSS 0.5%CVE-2026-81396HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-11528HIGHTenda AC18 Web Management getRebootStatus sub_45304 stack-based overflowEPSS 0.5%CVE-2025-67187CRITICALA stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The flaw exists in the setIpQosRules EPSS 0.5%CVE-2026-63526HIGHMicrosoft Office Graphics Component Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-81953HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-11523HIGHTenda W20E Web Management PortalAuth formPortalAuth stack-based overflowEPSS 0.5%CVE-2026-64907HIGHMicrosoft Office Word Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-55141HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-11504HIGHTenda CX12L Wi-Fi Schedule Configuration Endpoint openSchedWifi setSchedWifi stack-based overflowEPSS 0.5%CVE-2026-66807HIGHMicrosoft Office Graphics Component Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-64919HIGHMicrosoft Access Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-11522HIGHTenda W20E setPortMirror formSetPortMirror stack-based overflowEPSS 0.5%CVE-2026-68817HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%