Falhas do tipo CWE-126

581 resultados

Leitura além dos limites do buffer em pilha

A aplicação lê dados além do tamanho alocado de um buffer armazenado na pilha (stack), acessando memória que não deveria. Diferente do overflow que escreve, aqui o problema é ler lixo de memória adjacente, expondo informações sensíveis ou causando crash se a memória for inacessível.

Exemplo

Uma função copia uma string para um buffer de 16 bytes, mas depois tenta processar 32 bytes do buffer sem validar o tamanho real. O código lê dados da pilha que pertencem a outras variáveis ou endereços de retorno, vazando informações ou provocando segfault.

Como mitigar

Sempre validar o tamanho dos dados antes de ler; usar funções seguras (strlen, strnlen) com limites explícitos; ativar canários de pilha (stack canaries) no compilador para detectar corrupção; fazer code review focado em loops e operações de memória sem bounds checking.

CVE-2026-102728MEDIUMOut-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)EPSS 0.2%CVE-2025-21454HIGHBuffer Over-read in WLAN Embedded SWEPSS 0.2%CVE-2025-21449HIGHBuffer Over-read in WLAN Embedded SWEPSS 0.2%CVE-2025-21446HIGHBuffer Over-read in WLAN FirmwareEPSS 0.2%CVE-2025-21463HIGHBuffer Over-read in WLAN Host CommunicationEPSS 0.2%CVE-2023-43555HIGHBuffer Over-read in VideoEPSS 0.2%CVE-2026-28364HIGHIn OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution EPSS 0.2%CVE-2026-26184HIGHWindows Projected File System Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2023-3649MEDIUMBuffer Over-read in WiresharkEPSS 0.2%CVE-2026-5772LOWMatchDomainName 1-Byte Stack Buffer Over-Read in Hostname ValidationEPSS 0.2%CVE-2023-6992MEDIUMMemory corruption issues is Cloudflare zlib implementationEPSS 0.2%CVE-2025-47328HIGHBuffer Over-read in WLAN HALEPSS 0.2%CVE-2026-37532HIGHAGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-EPSS 0.2%CVE-2023-53159MEDIUMThe openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.EPSS 0.2%CVE-2023-43574MEDIUMA buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attackeEPSS 0.2%CVE-2023-43572MEDIUMA buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevaEPSS 0.2%CVE-2025-47318HIGHBuffer Over-read in BT ControllerEPSS 0.2%CVE-2025-12745MEDIUMQuickJS quickjs.c js_array_buffer_slice buffer over-readEPSS 0.2%CVE-2025-47401MEDIUMBuffer Over-read in WLAN HALEPSS 0.2%CVE-2025-47403MEDIUMBuffer Over-read in WLAN FirmwareEPSS 0.2%