Falhas do tipo CWE-822

248 resultados

Desreferência de ponteiro não confiável

Ocorre quando o código desreferencia um ponteiro cujo valor veio de uma fonte externa (entrada do usuário, rede, arquivo) sem validação prévia. Um atacante pode fornecer um endereço de memória inválido ou malicioso, causando crash, leitura de dados sensíveis ou execução de código arbitrário.

Exemplo

Um aplicativo recebe um offset de memória via requisição HTTP, converte para ponteiro e acessa dados sem verificar se o endereço é válido: int *ptr = (int *)user_input; int valor = *ptr;. O atacante fornece um endereço inválido ou que aponta para região protegida.

Como mitigar

Nunca confie em ponteiros ou endereços vindos de entrada externa. Se necessário, use estruturas de dados gerenciadas (arrays, listas), validação rigorosa de limites, ou isolamento via sandboxing. Em linguagens modernas (C++, Rust), prefira smart pointers e verificações em tempo de compilação.

CVE-2026-45645HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-4993HIGHUntrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.EPSS 0.4%CVE-2025-58749LOWWAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT modeEPSS 0.4%CVE-2025-1255HIGHUntrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.EPSS 0.4%CVE-2022-42396HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reEPSS 0.4%CVE-2025-47985HIGHWindows Event Tracing Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-49661HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-55230HIGHWindows MBT Transport Driver Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-44805MEDIUMWindows Network Controller (NC) Host Agent Denial of Service VulnerabilityEPSS 0.4%CVE-2026-64910HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.3%CVE-2022-34890HIGHThis vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 17.1.1 (51537). AEPSS 0.3%CVE-2018-7525—In Omron CX-Supervisor Versions 3.30 and prior, processing a malformed packet by a certain executable may cause an untrusted pointer dereferEPSS 0.3%CVE-2026-50441HIGHWindows Resilient File System (ReFS) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-50367HIGHWindows Sensor Data Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-50382HIGHDirectX Graphics Kernel Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-50479HIGHWindows USB Hub Driver Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2023-35711HIGHAshlar-Vellum Cobalt XE File Parsing Untrusted Pointer Dereference Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-32077HIGHWindows UPnP Device Host Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-32222HIGHWindows Win32k Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-33114HIGHMicrosoft Word Remote Code Execution VulnerabilityEPSS 0.3%