Falhas do tipo CWE-126

581 resultados

Leitura além dos limites do buffer em pilha

A aplicação lê dados além do tamanho alocado de um buffer armazenado na pilha (stack), acessando memória que não deveria. Diferente do overflow que escreve, aqui o problema é ler lixo de memória adjacente, expondo informações sensíveis ou causando crash se a memória for inacessível.

Exemplo

Uma função copia uma string para um buffer de 16 bytes, mas depois tenta processar 32 bytes do buffer sem validar o tamanho real. O código lê dados da pilha que pertencem a outras variáveis ou endereços de retorno, vazando informações ou provocando segfault.

Como mitigar

Sempre validar o tamanho dos dados antes de ler; usar funções seguras (strlen, strnlen) com limites explícitos; ativar canários de pilha (stack canaries) no compilador para detectar corrupção; fazer code review focado em loops e operações de memória sem bounds checking.

CVE-2026-20538MEDIUMIn Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE hasEPSS 0.2%CVE-2026-20539MEDIUMIn Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has conEPSS 0.2%CVE-2026-20541MEDIUMIn Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE hasEPSS 0.2%CVE-2026-20540MEDIUMIn Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has conEPSS 0.2%CVE-2026-18238MEDIUMOOBR in rpcap client in libpcap before 1.10.7EPSS 0.2%CVE-2026-93524MEDIUMX.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds ReadEPSS 0.2%CVE-2026-11787MEDIUM389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsingEPSS 0.2%CVE-2026-102758HIGHThe `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitivEPSS 0.2%CVE-2026-45684MEDIUMOpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffersEPSS 0.2%CVE-2026-0930LOWPotential wolfSSHd Buffer out-of-bounds Read on Windows Handling Terminal ResizeEPSS 0.2%CVE-2026-90610MEDIUMGPAC MP4Box svg_attributes.c gf_svg_attributes_copy buffer over-readEPSS 0.2%CVE-2026-57546HIGHBuffer Over-read in WLAN HALEPSS 0.2%CVE-2026-2394MEDIUMBuffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.EPSS 0.2%CVE-2026-25294HIGHBuffer Over-read in WLAN FirmwareEPSS 0.2%CVE-2026-24081HIGHBuffer Over-read in BT ControllerEPSS 0.2%CVE-2026-25288HIGHBuffer Over-read in WLAN FirmwareEPSS 0.2%CVE-2026-27798MEDIUMImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small imagesEPSS 0.2%CVE-2025-47402MEDIUMBuffer Over-read in WLAN FirmwareEPSS 0.2%CVE-2026-50813MEDIUMAn issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension chaEPSS 0.2%CVE-2026-21381HIGHBuffer Over-read in WLAN FirmwareEPSS 0.2%