Falhas do tipo CWE-822

250 resultados

Desreferência de ponteiro não confiável

Ocorre quando o código desreferencia um ponteiro cujo valor veio de uma fonte externa (entrada do usuário, rede, arquivo) sem validação prévia. Um atacante pode fornecer um endereço de memória inválido ou malicioso, causando crash, leitura de dados sensíveis ou execução de código arbitrário.

Exemplo

Um aplicativo recebe um offset de memória via requisição HTTP, converte para ponteiro e acessa dados sem verificar se o endereço é válido: int *ptr = (int *)user_input; int valor = *ptr;. O atacante fornece um endereço inválido ou que aponta para região protegida.

Como mitigar

Nunca confie em ponteiros ou endereços vindos de entrada externa. Se necessário, use estruturas de dados gerenciadas (arrays, listas), validação rigorosa de limites, ou isolamento via sandboxing. Em linguagens modernas (C++, Rust), prefira smart pointers e verificações em tempo de compilação.

CVE-2024-40872HIGHElevation of privilege in Absolute Secure Access clients and serversEPSS 0.2%CVE-2025-20018MEDIUMUntrusted pointer dereference for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privileEPSS 0.2%CVE-2021-26410LOWImproper syscall input validation in ASP (AMD Secure Processor) may force the kernel into reading syscall parameter values from its own memoEPSS 0.2%CVE-2024-25078HIGHA memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IBEPSS 0.1%CVE-2025-59959MEDIUMJunos OS and Junos OS Evolved: Executing a specific show command leads to an rpd crashEPSS 0.1%CVE-2024-12576MEDIUMGPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned addressEPSS 0.1%CVE-2025-20090MEDIUMUntrusted Pointer Dereference for some Intel(R) QuickAssist Technology software before version 2.5.0 may allow an authenticated user to poteEPSS 0.1%CVE-2025-27710MEDIUMUntrusted pointer dereference for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an infEPSS 0.1%CVE-2026-7406HIGHBMP File Parsing Untrusted Pointer Dereference in certain Autodesk productsEPSS 0.1%CVE-2024-36352HIGHImproper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to aEPSS 0.1%CVE-2025-52516MEDIUMAn issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. An invalEPSS 0.1%CVE-2026-94403CRITICALColorFul iGameCenter IOCTL ene.sys sub_140001AF0 untrusted pointer dereferenceEPSS 0.1%CVE-2026-18840HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2026-45198HIGHGPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrustedEPSS 0.1%CVE-2026-91795HIGHFoxit PDF Editor/Reader FileOpen Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.1%CVE-2026-19442HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2026-12364HIGHMissing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of serviceEPSS 0.1%CVE-2025-32446MEDIUMUntrusted pointer dereference for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allowEPSS 0.1%CVE-2026-19023MEDIUMHDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String DatasetsEPSS 0.1%CVE-2024-53033HIGHUntrusted Pointer Dereference in DSP_ServicesEPSS 0.1%