Falhas do tipo CWE-126

480 resultados

Leitura além dos limites do buffer em pilha

A aplicação lê dados além do tamanho alocado de um buffer armazenado na pilha (stack), acessando memória que não deveria. Diferente do overflow que escreve, aqui o problema é ler lixo de memória adjacente, expondo informações sensíveis ou causando crash se a memória for inacessível.

Exemplo

Uma função copia uma string para um buffer de 16 bytes, mas depois tenta processar 32 bytes do buffer sem validar o tamanho real. O código lê dados da pilha que pertencem a outras variáveis ou endereços de retorno, vazando informações ou provocando segfault.

Como mitigar

Sempre validar o tamanho dos dados antes de ler; usar funções seguras (strlen, strnlen) com limites explícitos; ativar canários de pilha (stack canaries) no compilador para detectar corrupção; fazer code review focado em loops e operações de memória sem bounds checking.

CVE-2023-35638HIGHDHCP Server Service Denial of Service VulnerabilityEPSS 3.3%CVE-2023-35643HIGHDHCP Server Service Information Disclosure VulnerabilityEPSS 2.6%CVE-2023-36392HIGHDHCP Server Service Denial of Service VulnerabilityEPSS 2.5%CVE-2026-26169MEDIUMWindows Kernel Memory Information Disclosure VulnerabilityEPSS 2.4%CVE-2023-36581HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.4%CVE-2025-21176HIGH.NET, .NET Framework, and Visual Studio Remote Code Execution VulnerabilityEPSS 2.3%CVE-2022-1720MEDIUMBuffer Over-read in function grab_file_name in vim/vimEPSS 2.2%CVE-2020-8244—A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even tyEPSS 2.2%CVE-2023-28267MEDIUMRemote Desktop Protocol Client Information Disclosure VulnerabilityEPSS 2.1%CVE-2022-1629MEDIUMBuffer Over-read in function find_next_quote in vim/vimEPSS 1.9%CVE-2023-24942HIGHRemote Procedure Call Runtime Denial of Service VulnerabilityEPSS 1.9%CVE-2023-35330HIGHWindows Extended Negotiation Denial of Service VulnerabilityEPSS 1.9%CVE-2023-38172HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 1.8%CVE-2024-43475HIGHMicrosoft Windows Admin Center Information Disclosure VulnerabilityEPSS 1.7%CVE-2019-3563—Wangle's LineBasedFrameDecoder contains logic for identifying newlines which incorrectly advances a buffer, leading to a potential underflowEPSS 1.7%CVE-2023-21811HIGHWindows iSCSI Service Denial of Service VulnerabilityEPSS 1.7%CVE-2023-21813HIGHWindows Secure Channel Denial of Service VulnerabilityEPSS 1.7%CVE-2023-21701HIGHMicrosoft Protected Extensible Authentication Protocol (PEAP) Denial of Service VulnerabilityEPSS 1.7%CVE-2025-26664MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.6%CVE-2025-26672MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.6%