Weaknesses of type CWE-787

5,136 results

Escrita fora dos limites da memória

Ocorre quando o código escreve dados em um endereço de memória fora do intervalo alocado para uma estrutura (array, buffer, objeto). O programa não valida o tamanho ou índice antes de escrever, permitindo sobrescrever memória adjacente — causando corrupção de dados, queda da aplicação ou execução arbitrária de código.

Example

Um formulário web que copia o valor de um campo do usuário para um buffer de 64 bytes sem verificar o comprimento: se o atacante enviar 200 caracteres, a escrita invade a memória vizinha e pode sobrescrever um ponteiro de função ou variável crítica.

How to mitigate

Sempre validar tamanhos de entrada antes de copiar (usar `strncpy` em vez de `strcpy`, ou bibliotecas seguras como `bounds-checking`); usar linguagens com verificação automática de limites (Java, Rust); aplicar testes de fuzzing e análise estática de código para detectar escritas desprotegidas.

CVE-2016-5198HIGHV8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect oEPSS 34.2%KEVCVE-2018-13383MEDIUMA heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxEPSS 33.6%KEVCVE-2022-4135CRITICALHeap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to pEPSS 31.9%KEVCVE-2026-0300CRITICALPAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication PortalEPSS 31.7%KEVCVE-2020-0968HIGHA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripEPSS 30.7%KEVCVE-2017-0222HIGHA remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorEPSS 29.6%KEVCVE-2018-8653HIGHA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripEPSS 29.6%KEVCVE-2020-12011—A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code executiEPSS 29.2%CVE-2017-0149HIGHMicrosoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vEPSS 29.2%KEVCVE-2021-30807HIGHA memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14EPSS 28.8%KEVCVE-2022-37969HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 28.3%KEVCVE-2023-52755CRITICALksmbd: fix slab out of bounds write in smb_inherit_dacl()EPSS 27.9%CVE-2025-27363HIGHAn out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parseEPSS 27.8%KEVCVE-2023-4355HIGHOut of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption vEPSS 27.7%CVE-2021-3490HIGHLinux kernel eBPF bitwise ops ALU32 bounds trackingEPSS 27.5%CVE-2025-14733CRITICALWatchGuard Firebox iked Out of Bounds Write VulnerabilityEPSS 26.5%KEVCVE-2009-1862HIGHUnspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.EPSS 24.9%KEVCVE-2022-41128HIGHWindows Scripting Languages Remote Code Execution VulnerabilityEPSS 24.6%KEVCVE-2020-1380HIGHScripting Engine Memory Corruption VulnerabilityEPSS 24.2%KEVCVE-2016-4656HIGHThe kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memoryEPSS 23.6%KEV