Falhas do tipo CWE-121

3.820 resultados

Estouro de buffer na pilha

Ocorre quando código escreve mais dados em um buffer alocado na pilha do que sua capacidade permite, sobrescrevendo dados adjacentes (variáveis, endereços de retorno). Um atacante pode explorar isso para executar código arbitrário ou crashar a aplicação alterando o fluxo de execução.

Exemplo

Uma função C que copia uma string do usuário diretamente em um array local sem validar tamanho: `char buffer[10]; strcpy(buffer, user_input);`. Se user_input tiver 50 caracteres, os 40 extras sobrescrevem a pilha, incluindo potencialmente o endereço de retorno da função.

Como mitigar

Use funções seguras que limitam escrita (strncpy, snprintf em vez de strcpy/sprintf), valide tamanho de entrada antes de copiar, ative proteções do compilador (stack canaries, ASLR) e use ferramentas de análise estática para detectar cópias sem limite.

CVE-2018-8847—Eaton 9000X DriveA versions 2.0.29 and prior has a stack-based buffer overflow vulnerability, which may allow remote code execution.EPSS 6.8%CVE-2025-11418CRITICALTenda CH22 HTTP Request AdvSetWrlsafeset formWrlsafeset stack-based overflowEPSS 6.7%CVE-2025-14879CRITICALTenda WH450 HTTP Request onSSIDChange stack-based overflowEPSS 6.7%CVE-2025-51088MEDIUMTenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/WifiGuestSet. The manipulation of the argument `shareSpeed` leEPSS 6.6%CVE-2025-51085MEDIUMTenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/SetSysTimeCfg. The manipulation of the argument `timeZone` andEPSS 6.6%CVE-2021-27246HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 AC1750 1.0.15 EPSS 6.6%CVE-2026-1457HIGHAuthenticated RCE Vulnerability Due to Buffer Overflow on TP-Link VIGI C385EPSS 6.6%CVE-2026-11499CRITICALTenda HG7HG9/HG10 formDOMAINBLK stack-based overflowEPSS 6.6%CVE-2020-15416HIGHThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 rEPSS 6.4%CVE-2020-9748HIGHStack overflow vulnerability in Adobe Animate 20.5EPSS 6.3%CVE-2014-9190—Schneider Electric Wonderware InTouch Access Anywhere Server Buffer OverflowEPSS 6.2%CVE-2019-10954—Rockwell Automation CompactLogix 5370 Stack-based Buffer OverflowEPSS 6.1%CVE-2019-6550—Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validaEPSS 6.1%CVE-2024-35387CRITICALTOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.EPSS 6.1%CVE-2025-7091HIGHBelkin F9K1122 webs formWlanMP stack-based overflowEPSS 6.0%CVE-2021-28606HIGHAdobe After Effects Stack Overflow vulnerability could lead to arbitrary code executionEPSS 5.9%CVE-2021-28797CRITICALStack Buffer Overflow in Surveillance StationEPSS 5.9%CVE-2019-13548—CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could causEPSS 5.8%CVE-2025-5572HIGHD-Link DCS-932L setSystemEmail stack-based overflowEPSS 5.8%CVE-2018-8865—In Lantech IDS 2102 2.0 and prior, a stack-based buffer overflow vulnerability has been identified which may allow remote code execution. A EPSS 5.7%