Falhas do tipo CWE-822

308 resultados

Desreferência de ponteiro não confiável

Ocorre quando o código desreferencia um ponteiro cujo valor veio de uma fonte externa (entrada do usuário, rede, arquivo) sem validação prévia. Um atacante pode fornecer um endereço de memória inválido ou malicioso, causando crash, leitura de dados sensíveis ou execução de código arbitrário.

Exemplo

Um aplicativo recebe um offset de memória via requisição HTTP, converte para ponteiro e acessa dados sem verificar se o endereço é válido: int *ptr = (int *)user_input; int valor = *ptr;. O atacante fornece um endereço inválido ou que aponta para região protegida.

Como mitigar

Nunca confie em ponteiros ou endereços vindos de entrada externa. Se necessário, use estruturas de dados gerenciadas (arrays, listas), validação rigorosa de limites, ou isolamento via sandboxing. Em linguagens modernas (C++, Rust), prefira smart pointers e verificações em tempo de compilação.

CVE-2026-10420MEDIUMUntrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 10EPSS 0.1%CVE-2025-27710MEDIUMUntrusted pointer dereference for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an infEPSS 0.1%CVE-2026-115653HIGHCortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged modeEPSS 0.1%CVE-2026-19595MEDIUMZephyr RTIO syscall verifier validates output parameters for read instead of write accessEPSS 0.1%CVE-2025-20090MEDIUMUntrusted Pointer Dereference for some Intel(R) QuickAssist Technology software before version 2.5.0 may allow an authenticated user to poteEPSS 0.1%CVE-2025-59959MEDIUMJunos OS and Junos OS Evolved: Executing a specific show command leads to an rpd crashEPSS 0.1%CVE-2026-9771HIGHMissing device-pointer validation in flash_copy() syscall allows userspace privilege escalationEPSS 0.1%CVE-2026-113780CRITICALESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch BoundaryEPSS 0.1%CVE-2026-90890MEDIUMASRock｜ASRock Polychrome SYNC/RGB software utility - Untrusted Pointer DereferenceEPSS 0.1%CVE-2024-36352HIGHImproper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to aEPSS 0.1%CVE-2025-52516MEDIUMAn issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. An invalEPSS 0.1%CVE-2026-33964MEDIUMAn issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500. An untrusted pointer dereference occurs when a malformedEPSS 0.1%CVE-2025-32446MEDIUMUntrusted pointer dereference for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allowEPSS 0.1%CVE-2026-91795HIGHFoxit PDF Editor/Reader FileOpen Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.1%CVE-2024-53033HIGHUntrusted Pointer Dereference in DSP_ServicesEPSS 0.1%CVE-2024-53034HIGHUntrusted Pointer Dereference in DSP_ServicesEPSS 0.1%CVE-2026-97876MEDIUMBypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base addressEPSS 0.1%CVE-2026-87041HIGHInverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memoryEPSS 0.1%CVE-2026-110322MEDIUMHMS Networks PEAK-System PCAN Windows drivers Untrusted Pointer DereferenceEPSS 0.1%CVE-2026-88781MEDIUMUntrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory addEPSS 0.1%