Falhas do tipo CWE-823

100 resultados

Uso de deslocamento de ponteiro fora do intervalo válido

Fraqueza onde o código calcula ou usa um deslocamento de ponteiro que aponta para fora dos limites válidos de um objeto na memória. Isso causa acesso a regiões de memória não alocadas ou não destinadas, levando a corrupção de dados, crash ou execução arbitrária de código.

Exemplo

Um buffer de 100 bytes é alocado, mas o código tenta acessar posição 150 usando aritmética de ponteiros (ptr + 50). Ou ao fazer cálculos com deslocamentos inteiros que não validam se o resultado aponta para dentro da alocação original.

Como mitigar

Validar sempre o intervalo de deslocamentos antes de usá-los (verificar se offset < tamanho_alocado). Usar bibliotecas seguras que encapsulam aritmética de ponteiros, ou linguagens com verificação de bounds automática (Rust, TypeScript). Em C/C++, realizar audit rigoroso de cálculos envolvendo sizeof e offsets.

CVE-2016-2161—In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continueEPSS 21.0%CVE-2020-6112HIGHAn exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2EPSS 17.1%CVE-2020-27009HIGHA vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions <EPSS 7.2%CVE-2023-46724HIGHSQUID-2023:4 Denial of Service in SSL Certificate validationEPSS 4.0%CVE-2020-13573HIGHA denial-of-service vulnerability exists in the Ethernet/IP server functionality of Rockwell Automation RSLinx Classic 2.57.00.14 CPR 9 SR 3EPSS 3.4%CVE-2022-0685HIGHUse of Out-of-range Pointer Offset in vim/vimEPSS 1.7%CVE-2022-0729HIGHUse of Out-of-range Pointer Offset in vim/vimEPSS 1.6%CVE-2022-0554HIGHUse of Out-of-range Pointer Offset in vim/vimEPSS 1.6%CVE-2022-46377MEDIUMAn out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A spEPSS 1.5%CVE-2022-1420MEDIUMUse of Out-of-range Pointer Offset in vim/vimEPSS 1.5%CVE-2022-46378MEDIUMAn out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A spEPSS 1.4%CVE-2021-3889HIGHUse of Out-of-range Pointer Offset in bfabiszewski/libmobiEPSS 1.2%CVE-2021-3888HIGHUse of Out-of-range Pointer Offset in bfabiszewski/libmobiEPSS 1.2%CVE-2022-32142HIGHCODESYS runtime system prone to denial of service due to use of out of range pointerEPSS 1.0%CVE-2026-42946HIGHNGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerabilityEPSS 0.9%CVE-2022-0614HIGHUse of Out-of-range Pointer Offset in mruby/mrubyEPSS 0.9%CVE-2021-34595HIGHCODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-serviceEPSS 0.9%CVE-2023-33106HIGHUse of Out-of-range Pointer Offset in GraphicsEPSS 0.8%KEVCVE-2017-20211HIGHUCanCode E-XD++ Visualization Enterprise Suite Untrusted Pointer Dereference RCEEPSS 0.7%CVE-2026-4693HIGHIncorrect boundary conditions in the Audio/Video: Playback componentEPSS 0.7%