Weaknesses of type CWE-787

5,137 results

Escrita fora dos limites da memória

Ocorre quando o código escreve dados em um endereço de memória fora do intervalo alocado para uma estrutura (array, buffer, objeto). O programa não valida o tamanho ou índice antes de escrever, permitindo sobrescrever memória adjacente — causando corrupção de dados, queda da aplicação ou execução arbitrária de código.

Example

Um formulário web que copia o valor de um campo do usuário para um buffer de 64 bytes sem verificar o comprimento: se o atacante enviar 200 caracteres, a escrita invade a memória vizinha e pode sobrescrever um ponteiro de função ou variável crítica.

How to mitigate

Sempre validar tamanhos de entrada antes de copiar (usar `strncpy` em vez de `strcpy`, ou bibliotecas seguras como `bounds-checking`); usar linguagens com verificação automática de limites (Java, Rust); aplicar testes de fuzzing e análise estática de código para detectar escritas desprotegidas.

CVE-2011-2462HIGHUnspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x EPSS 86.6%KEVCVE-2018-1160CRITICALNetatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlEPSS 86.5%CVE-2009-3129HIGHMicrosoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; OfficEPSS 85.6%KEVCVE-2009-3953HIGHThe U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remotEPSS 83.9%KEVCVE-2012-1889HIGHMicrosoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitraEPSS 83.5%KEVCVE-2024-21762CRITICALA out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2EPSS 83.4%KEVCVE-2016-7200HIGHThe Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memEPSS 82.9%KEVCVE-2010-2883HIGHStack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allowsEPSS 82.4%KEVCVE-2010-1297HIGHAdobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3,EPSS 82.2%KEVCVE-2020-14871CRITICALVulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affeEPSS 80.2%KEVCVE-2013-3346HIGHAdobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a EPSS 78.9%KEVCVE-2021-22555HIGHHeap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEEPSS 78.7%KEVCVE-2023-38545HIGHThis flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKEPSS 78.5%CVE-2021-1732HIGHWindows Win32k Elevation of Privilege VulnerabilityEPSS 78.4%KEVCVE-2014-1761HIGHMicrosoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; WorEPSS 77.5%KEVCVE-2021-39843HIGHAdobe Acrobat Reader XObject Out-of-Bound Write VulnerabilityEPSS 76.7%CVE-2021-38406HIGHDelta Electronics DOPSoft 2 Out-of-Bounds WriteEPSS 76.4%KEVCVE-2015-3043HIGHAdobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attEPSS 73.9%KEVCVE-2013-3918HIGHThe InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows VEPSS 73.7%KEVCVE-2021-44142HIGHThe Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoEPSS 73.4%