目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-120 未进行输入大小检查的缓冲区拷贝(传统缓冲区溢出) 类漏洞列表 1857

CWE-120 未进行输入大小检查的缓冲区拷贝(传统缓冲区溢出) 类弱点 1857 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-120 即经典缓冲区溢出，属于内存安全漏洞。当程序将输入数据复制到输出缓冲区时，若未验证输入大小是否超出目标容量，会导致内存越界写入。攻击者利用此缺陷可覆盖相邻内存数据，进而执行恶意代码或导致系统崩溃。开发者应严格校验输入长度，使用安全的边界检查函数，并确保目标缓冲区足够大，从而从根本上杜绝此类风险。

MITRE CWE 官方描述
CWE：CWE-120 未检查输入大小的缓冲区复制（'Classic Buffer Overflow'） 英文：产品将输入缓冲区复制到输出缓冲区，但未验证输入缓冲区的大小是否小于输出缓冲区的大小。
常见影响 (2)
Integrity, Confidentiality, AvailabilityModify Memory, Execute Unauthorized Code or Commands
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of the product's implicit security policy. This can often be used to subvert any other security service.
AvailabilityModify Memory, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the product into an infinite loop.
缓解措施 (5)
RequirementsUse a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a lan…
Architecture and DesignUse a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.
Operation, Build and CompilationUse automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses…
Effectiveness: Defense in Depth
ImplementationConsider adhering to the following rules when allocating and managing an application's memory: Double check that your buffer is as large as you specify. When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string. Check buffer boundaries if accessing the buffer i…
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
代码示例 (2)
The following code asks the user to enter their last name and then attempts to store the value entered in the last_name array.
char last_name[20]; printf ("Enter your last name: "); scanf ("%s", last_name);
Bad · C
The following code attempts to create a local copy of a buffer to perform some manipulations to the data.
void manipulate_string(char * string){ char buf[24]; strcpy(buf, string); ... }
Bad · C
CVE ID标题CVSS风险等级Published
CVE-2025-11698 ControlLogix/CompactLogix 缓冲区溢出漏洞 — CompactLogix® 5380 Recovery Image Compact GuardLogix® 5380 Recovery Image CompactLogix® 5480 Recovery Image ControlLogix® 5580 Recovery Image GuardLogix® 5580 Recovery Image--2026-07-14
CVE-2025-12012 CompactLogix 等控制器缓冲区溢出漏洞 — CompactLogix® 5370 Compact GuardLogix® 5370 ControlLogix® 5570 GuardLogix® 5570--2026-07-14
CVE-2025-12011 罗克韦尔自动化控制器缓冲区溢出漏洞 — CompactLogix® 5370 Compact GuardLogix® 5370 ControlLogix® 5570 GuardLogix® 5570--2026-07-14
CVE-2025-8412 VMDP：RtlQueryRegistryValues函数潜在缓冲区溢出漏洞 — Virtual Machine Driver Pack--2026-07-14
CVE-2026-15543 Tenda CH22 CertListInfo 缓冲区溢出漏洞 — CH22 8.8 High2026-07-13
CVE-2026-15484 TRENDnet TEW-821DAP 缓冲区溢出漏洞 — TEW-821DAP 8.8 High2026-07-12
CVE-2026-15483 TRENDnet TEW-821DAP 缓冲区溢出漏洞 — TEW-821DAP 8.8 High2026-07-12
CVE-2026-29009 U-Boot 缓冲区错误漏洞 — u-boot 8.2 High2026-07-08
CVE-2026-57246 Foxit PDF Editor 缓冲区错误漏洞 — Foxit PDF Editor 7.8 High2026-07-08
CVE-2026-8247 WatchGuard fireware 缓冲区错误漏洞 — Fireware OS--2026-07-02
CVE-2026-57278 GeoVision GeoWebPlayer 缓冲区错误漏洞 — GeoWebPlayer 8.3 High2026-07-02
CVE-2026-57277 GeoVision GeoWebPlayer 缓冲区错误漏洞 — GeoWebPlayer 8.3 High2026-07-02
CVE-2026-57276 GeoVision GeoWebPlayer 缓冲区错误漏洞 — GeoWebPlayer 8.3 High2026-07-02
CVE-2026-57275 GeoVision GeoWebPlayer 缓冲区错误漏洞 — GeoWebPlayer 8.3 High2026-07-02
CVE-2026-57274 GeoVision GeoWebPlayer 缓冲区错误漏洞 — GeoWebPlayer 8.3 High2026-07-02
CVE-2026-57273 GeoVision GeoWebPlayer 缓冲区错误漏洞 — GeoWebPlayer 8.3 High2026-07-02
CVE-2026-20243 Cisco Secure Endpoint 缓冲区错误漏洞 — Cisco Secure Endpoint 7.5 High2026-07-01
CVE-2026-20244 Cisco Secure Endpoint 缓冲区错误漏洞 — Cisco Secure Endpoint 7.5 High2026-07-01
CVE-2026-20215 Cisco Secure Endpoint 缓冲区错误漏洞 — Cisco Secure Endpoint 7.5 High2026-07-01
CVE-2026-20217 Cisco Secure Endpoint 缓冲区错误漏洞 — Cisco Secure Endpoint 7.5 High2026-07-01
CVE-2026-20213 Cisco Secure Endpoint 缓冲区错误漏洞 — Cisco Secure Endpoint 7.5 High2026-07-01
CVE-2026-20214 Cisco Secure Endpoint 缓冲区错误漏洞 — Cisco Secure Endpoint 7.5 High2026-07-01
CVE-2026-6688 ChaN FatFs 缓冲区错误漏洞 — FatFs 7.6 High2026-07-01
CVE-2026-13583 edimax ew-7478apc 缓冲区错误漏洞 — EW-7478APC 8.8 High2026-06-29
CVE-2026-13582 edimax ew-7478apc 缓冲区错误漏洞 — EW-7478APC 8.8 High2026-06-29
CVE-2026-13580 edimax ew-7478apc 缓冲区错误漏洞 — EW-7478APC 8.8 High2026-06-29
CVE-2026-13562 Edimax ew-7478apc 缓冲区错误漏洞 — EW-7478APC 8.8 High2026-06-29
CVE-2026-48706 Envoy Proxy Envoy 缓冲区错误漏洞 — envoy 5.9 Medium2026-06-26
CVE-2026-57874 GeoVision GV-LPC2011 缓冲区错误漏洞 — GV-LPCLPC2011/2211 7.5 High2026-06-26
CVE-2026-12246 NLnet Labs NSD 缓冲区错误漏洞 — NSD--2026-06-25

CWE-120（未进行输入大小检查的缓冲区拷贝(传统缓冲区溢出)） 是常见的弱点类别，本平台收录该类弱点关联的 1857 条 CVE 漏洞。