Weaknesses of type CWE-787

5,844 results

Escrita fora dos limites da memória

Ocorre quando o código escreve dados em um endereço de memória fora do intervalo alocado para uma estrutura (array, buffer, objeto). O programa não valida o tamanho ou índice antes de escrever, permitindo sobrescrever memória adjacente — causando corrupção de dados, queda da aplicação ou execução arbitrária de código.

Example

Um formulário web que copia o valor de um campo do usuário para um buffer de 64 bytes sem verificar o comprimento: se o atacante enviar 200 caracteres, a escrita invade a memória vizinha e pode sobrescrever um ponteiro de função ou variável crítica.

How to mitigate

Sempre validar tamanhos de entrada antes de copiar (usar `strncpy` em vez de `strcpy`, ou bibliotecas seguras como `bounds-checking`); usar linguagens com verificação automática de limites (Java, Rust); aplicar testes de fuzzing e análise estática de código para detectar escritas desprotegidas.

CVE-2018-25223CRITICALCrashmail 1.6 Stack-based Buffer Overflow Remote Code ExecutionEPSS 0.9%CVE-2021-33647—When performing the inference shape operation of the Tile operator, if the input data type is not int or int32, it will access data outside EPSS 0.9%CVE-2023-23519HIGHA memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iEPSS 0.9%CVE-2022-35067MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41b0.EPSS 0.9%CVE-2022-28642HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. EPSS 0.9%CVE-2022-28646HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.2.034. EPSS 0.9%CVE-2022-28643HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. EPSS 0.9%CVE-2022-35036MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e1fc8.EPSS 0.9%CVE-2022-35035MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b559f.EPSS 0.9%CVE-2022-28644HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. EPSS 0.9%CVE-2022-46109HIGHTenda AC15 V15.03.06.23 is vulnerable to Buffer Overflow via function formSetClientState.EPSS 0.9%CVE-2023-1812HIGHOut of bounds memory access in DOM Bindings in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform out of bounds memorEPSS 0.9%CVE-2026-53266HIGHnetfilter: bridge: make ebt_snat ARP rewrite writableEPSS 0.9%KEVCVE-2023-33639HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspForEPSS 0.9%CVE-2023-33642HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.EPSS 0.9%CVE-2023-33631HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelSTList interface at /goform/aspForm.EPSS 0.9%CVE-2023-33635HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm.EPSS 0.9%CVE-2023-33643HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /goform/aspForm.EPSS 0.9%CVE-2023-33637HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm.EPSS 0.9%CVE-2023-33638HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.EPSS 0.9%