Weaknesses of type CWE-787

5,843 results

Escrita fora dos limites da memória

Ocorre quando o código escreve dados em um endereço de memória fora do intervalo alocado para uma estrutura (array, buffer, objeto). O programa não valida o tamanho ou índice antes de escrever, permitindo sobrescrever memória adjacente — causando corrupção de dados, queda da aplicação ou execução arbitrária de código.

Example

Um formulário web que copia o valor de um campo do usuário para um buffer de 64 bytes sem verificar o comprimento: se o atacante enviar 200 caracteres, a escrita invade a memória vizinha e pode sobrescrever um ponteiro de função ou variável crítica.

How to mitigate

Sempre validar tamanhos de entrada antes de copiar (usar `strncpy` em vez de `strcpy`, ou bibliotecas seguras como `bounds-checking`); usar linguagens com verificação automática de limites (Java, Rust); aplicar testes de fuzzing e análise estática de código para detectar escritas desprotegidas.

CVE-2022-43253MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_unweighted_pred_16_fallback in fallback-motion.cc. ThEPSS 1.1%CVE-2022-43243MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_weighted_pred_avg_8_sse in sse-motion.cc. ThiEPSS 1.1%CVE-2022-43239MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_chroma<unsigned short> in motion.cc. This vulnerabilitEPSS 1.1%CVE-2022-43244MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. EPSS 1.1%CVE-2022-43240MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_qpel_h_2_v_1_sse in sse-motion.cc. This EPSS 1.1%CVE-2022-43252MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_16_fallback in fallback-motion.cc. This vulnerabEPSS 1.1%CVE-2022-43249MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_hv_fallback<unsigned short> in fallback-motion.cEPSS 1.1%CVE-2022-42171CRITICALTenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/saveParentControlInfo.EPSS 1.1%CVE-2022-42165CRITICALTenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetDeviceName.EPSS 1.1%CVE-2022-41415CRITICALAcer Altos W2000h-W570h F4 R01.03.0018 was discovered to contain a stack overflow in the RevserveMem component. This vulnerability allows atEPSS 1.1%CVE-2022-42166CRITICALTenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetSpeedWan.EPSS 1.1%CVE-2022-42170CRITICALTenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formWifiWpsStart.EPSS 1.1%CVE-2022-42169CRITICALTenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/addWifiMacFilter.EPSS 1.1%CVE-2022-42168CRITICALTenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/fromSetIpMacBind.EPSS 1.1%CVE-2022-40861HIGHTenda AC18 router V15.03.05.19 contains a stack overflow vulnerability in the formSetQosBand->FUN_0007db78 function with the request /goformEPSS 1.1%CVE-2024-47615HIGHGHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxerEPSS 1.1%CVE-2021-26623HIGHBandisoft ARK Library Out-of-bound VulnerabilityEPSS 1.1%CVE-2022-28181HIGHNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user on theEPSS 1.1%CVE-2022-31705HIGHVMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). A malicious actor wiEPSS 1.1%CVE-2022-43294CRITICALTasmota before commit 066878da4d4762a9b6cb169fdf353e804d735cfd was discovered to contain a stack overflow via the ClientPortPtr parameter atEPSS 1.1%