Weaknesses of type CWE-123

50 results

Condição de escrita em local arbitrário

Uma vulnerabilidade onde o atacante consegue escrever dados em um endereço de memória arbitrário, tipicamente por falta de validação de ponteiros ou índices. O perigo é grave: permite sobrescrever variáveis críticas, estruturas de controle, código ou metadados, levando a execução de código arbitrário ou corrupção de dados.

Example

Um programa recebe um índice de usuário sem validar e usa diretamente para escrever em um array: `array[indice] = valor`. Um atacante passa um índice negativo ou muito grande, escrevendo fora dos limites e sobrescrevendo endereços de memória que não deveria.

How to mitigate

Valide todos os índices e ponteiros antes de qualquer operação de escrita — implemente bounds checking. Use linguagens com proteção automática (Rust, Go) ou, em C/C++, ferramentas como AddressSanitizer durante testes e ASLR em runtime para dificultar exploração.

CVE-2026-43284HIGHxfrm: esp: avoid in-place decrypt on shared skb fragsEPSS 93.2%CVE-2026-43500HIGHrxrpc: Also unshare DATA/RESPONSE packets when paged frags are presentEPSS 92.9%CVE-2026-46300HIGHnet: skbuff: preserve shared-frag marker during coalescingEPSS 7.0%CVE-2025-55298HIGHImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code executionEPSS 4.4%CVE-2014-5435—An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6EPSS 3.5%CVE-2024-42479CRITICALllama.cpp allows write-what-where in rpc_server::set_tensorEPSS 2.6%CVE-2020-16225—Delta Electronics TPEditor Versions 1.97 and prior. A write-what-where condition may be exploited by processing a specially crafted project EPSS 2.1%CVE-2021-38441MEDIUMEclipse CycloneDDS Write-what-where ConditionEPSS 2.0%CVE-2022-38143CRITICALA heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. A specially-crafted bmp fEPSS 1.4%CVE-2020-7560—A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStEPSS 1.4%CVE-2020-2001HIGHPAN-OS: Panorama External control of file vulnerability leads to privilege escalationEPSS 1.3%CVE-2021-38449CRITICALAUVESY VersiondogEPSS 1.2%CVE-2024-2607HIGHReturn registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue only affected Armv7-A sEPSS 1.1%CVE-2025-22225HIGHVMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kerEPSS 1.0%KEVCVE-2021-42540HIGHEmerson WirelessHART GatewayEPSS 1.0%CVE-2025-62164HIGHVLLM deserialization vulnerability leading to DoS and potential RCEEPSS 0.9%CVE-2025-9900HIGHLibtiff: libtiff write-what-whereEPSS 0.7%CVE-2022-37904MEDIUMVulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequenEPSS 0.7%CVE-2024-36877HIGHMicro-Star International Z-series motherboards (Z590, Z490, and Z790) and B-series motherboards (B760, B560, B660, and B460) with firmware 7EPSS 0.7%CVE-2022-41757HIGHAn issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to obtain writeEPSS 0.7%