Weaknesses of type CWE-787

5,843 results

Escrita fora dos limites da memória

Ocorre quando o código escreve dados em um endereço de memória fora do intervalo alocado para uma estrutura (array, buffer, objeto). O programa não valida o tamanho ou índice antes de escrever, permitindo sobrescrever memória adjacente — causando corrupção de dados, queda da aplicação ou execução arbitrária de código.

Example

Um formulário web que copia o valor de um campo do usuário para um buffer de 64 bytes sem verificar o comprimento: se o atacante enviar 200 caracteres, a escrita invade a memória vizinha e pode sobrescrever um ponteiro de função ou variável crítica.

How to mitigate

Sempre validar tamanhos de entrada antes de copiar (usar `strncpy` em vez de `strcpy`, ou bibliotecas seguras como `bounds-checking`); usar linguagens com verificação automática de limites (Java, Rust); aplicar testes de fuzzing e análise estática de código para detectar escritas desprotegidas.

CVE-2021-30498—A flaw was found in libcaca. A heap buffer overflow in export.c in function export_tga might lead to memory corruption and other potential cEPSS 1.3%CVE-2022-28665MEDIUMA memory corruption vulnerability exists in the httpd unescape functionality of FreshTomato 2022.1. A specially-crafted HTTP request can leaEPSS 1.3%CVE-2024-47541MEDIUMGHSL-2024-228: GStreamer has an out-of-bounds write in SSA subtitle parserEPSS 1.3%CVE-2021-27399—A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MEPSS 1.3%CVE-2021-25665—A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < V2021.2.1). The starview+.exe application lacks proper valEPSS 1.3%CVE-2021-27387—A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MEPSS 1.3%CVE-2026-70058HIGHWindows DHCP Server Remote Code Execution VulnerabilityEPSS 1.3%CVE-2022-31901MEDIUMBuffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two craftEPSS 1.3%CVE-2021-27634HIGHSAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.EPSS 1.3%CVE-2024-47539HIGHGHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1aEPSS 1.3%CVE-2022-47388HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47382HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47384HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47380HIGHCODESYS: Multiple products prone to out-of-bounds writeEPSS 1.3%CVE-2022-47387HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47381HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47383HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2021-38684HIGHBuffer Overflow Vulnerability in Multimedia ConsoleEPSS 1.3%CVE-2022-47389HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47390HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%