Falhas do tipo CWE-126

581 resultados

Leitura além dos limites do buffer em pilha

A aplicação lê dados além do tamanho alocado de um buffer armazenado na pilha (stack), acessando memória que não deveria. Diferente do overflow que escreve, aqui o problema é ler lixo de memória adjacente, expondo informações sensíveis ou causando crash se a memória for inacessível.

Exemplo

Uma função copia uma string para um buffer de 16 bytes, mas depois tenta processar 32 bytes do buffer sem validar o tamanho real. O código lê dados da pilha que pertencem a outras variáveis ou endereços de retorno, vazando informações ou provocando segfault.

Como mitigar

Sempre validar o tamanho dos dados antes de ler; usar funções seguras (strlen, strnlen) com limites explícitos; ativar canários de pilha (stack canaries) no compilador para detectar corrupção; fazer code review focado em loops e operações de memória sem bounds checking.

CVE-2023-4758MEDIUMBuffer Over-read in gpac/gpacEPSS 0.3%CVE-2024-49847HIGHBuffer Over-read in Multi-Mode Call ProcessorEPSS 0.3%CVE-2024-9843MEDIUMA buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to cause a denial of service.EPSS 0.3%CVE-2024-53019HIGHBuffer Over-read in Data Network Stack & ConnectivityEPSS 0.3%CVE-2025-27029HIGHBuffer Over-read in WLAN HALEPSS 0.3%CVE-2024-53021HIGHBuffer Over-read in Data Network Stack & ConnectivityEPSS 0.3%CVE-2025-27065HIGHBuffer Over-read in WLAN FirmwareEPSS 0.3%CVE-2024-53020HIGHBuffer Over-read in Data Network Stack & ConnectivityEPSS 0.3%CVE-2024-38405HIGHBuffer Over-read in WLAN HostEPSS 0.3%CVE-2024-38403HIGHBuffer Over-read in WLAN FirmwareEPSS 0.3%CVE-2024-38404HIGHBuffer Over-read in Multi Mode Call ProcessorEPSS 0.3%CVE-2026-20311MEDIUMCisco IOS XE Software Web UI Denial of Service VulnerabilityEPSS 0.3%CVE-2025-55083MEDIUMBroken bounds check in Broken bounds check in _nx_secure_tls_process_clienthello_psk_extension()EPSS 0.3%CVE-2026-65933MEDIUMBT122 malformed packet with increased length field causes memory leakEPSS 0.3%CVE-2026-65936MEDIUMRS9116W/SiWx917 malformed packet with increased length field causes memory leakEPSS 0.3%CVE-2024-57970MEDIUMlibarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive becEPSS 0.3%CVE-2026-124317MEDIUMlibexpat through 2.10.0 Out-of-Bounds Read via unknown_toUtf8 and unknown_toUtf16EPSS 0.2%CVE-2025-27057HIGHBuffer Over-read in WLAN HostEPSS 0.2%CVE-2025-47326HIGHBuffer Over-read in WLAN HALEPSS 0.2%CVE-2026-102728MEDIUMOut-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)EPSS 0.2%