Weaknesses of type CWE-787

5,145 results

Escrita fora dos limites da memória

Ocorre quando o código escreve dados em um endereço de memória fora do intervalo alocado para uma estrutura (array, buffer, objeto). O programa não valida o tamanho ou índice antes de escrever, permitindo sobrescrever memória adjacente — causando corrupção de dados, queda da aplicação ou execução arbitrária de código.

Example

Um formulário web que copia o valor de um campo do usuário para um buffer de 64 bytes sem verificar o comprimento: se o atacante enviar 200 caracteres, a escrita invade a memória vizinha e pode sobrescrever um ponteiro de função ou variável crítica.

How to mitigate

Sempre validar tamanhos de entrada antes de copiar (usar `strncpy` em vez de `strcpy`, ou bibliotecas seguras como `bounds-checking`); usar linguagens com verificação automática de limites (Java, Rust); aplicar testes de fuzzing e análise estática de código para detectar escritas desprotegidas.

CVE-2020-36773CRITICALArtifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a singleEPSS 0.9%CVE-2022-44931HIGHTenda A18 v15.13.07.09 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.EPSS 0.9%CVE-2024-20039HIGHIn modem protocol, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no aEPSS 0.9%CVE-2026-56211HIGHLibaom: libaom: remote code execution via svc layer context handling with attacker-controlled framesEPSS 0.9%CVE-2022-40648HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.9%CVE-2022-3200HIGHHeap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption EPSS 0.9%CVE-2023-2854MEDIUMBLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture fileEPSS 0.9%CVE-2023-5474HIGHHeap buffer overflow in PDF in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who convinced a user to engage in specific useEPSS 0.9%CVE-2023-2857MEDIUMBLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture fileEPSS 0.9%CVE-2022-35029MEDIUMOTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6babea.EPSS 0.9%CVE-2022-35025MEDIUMOTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x5266a8.EPSS 0.9%CVE-2022-35031MEDIUMOTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x703969.EPSS 0.9%CVE-2022-35030MEDIUMOTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe954.EPSS 0.9%CVE-2022-35027MEDIUMOTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe9a7.EPSS 0.9%CVE-2022-35023MEDIUMOTFCC commit 617837b was discovered to contain a segmentation violation via /lib/x86_64-linux-gnu/libc.so.6+0xbb384.EPSS 0.9%CVE-2022-35022MEDIUMOTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6badae.EPSS 0.9%CVE-2022-35026MEDIUMOTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbc0b.EPSS 0.9%CVE-2022-35028MEDIUMOTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbbb6.EPSS 0.9%CVE-2022-47126CRITICALTenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.EPSS 0.9%CVE-2022-43618HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506.EPSS 0.9%