Weaknesses of type CWE-787

5,145 results

Escrita fora dos limites da memória

Ocorre quando o código escreve dados em um endereço de memória fora do intervalo alocado para uma estrutura (array, buffer, objeto). O programa não valida o tamanho ou índice antes de escrever, permitindo sobrescrever memória adjacente — causando corrupção de dados, queda da aplicação ou execução arbitrária de código.

Example

Um formulário web que copia o valor de um campo do usuário para um buffer de 64 bytes sem verificar o comprimento: se o atacante enviar 200 caracteres, a escrita invade a memória vizinha e pode sobrescrever um ponteiro de função ou variável crítica.

How to mitigate

Sempre validar tamanhos de entrada antes de copiar (usar `strncpy` em vez de `strcpy`, ou bibliotecas seguras como `bounds-checking`); usar linguagens com verificação automática de limites (Java, Rust); aplicar testes de fuzzing e análise estática de código para detectar escritas desprotegidas.

CVE-2022-45501HIGHTenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the wl_radio parameter at /goform/wifiSSIDset.EPSS 0.9%CVE-2022-45513HIGHTenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/P2pListFilter.EPSS 0.9%CVE-2022-45519HIGHTenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the Go parameter at /goform/SafeMacFilter.EPSS 0.9%CVE-2023-51963CRITICALTenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function setIptvInfo.EPSS 0.9%CVE-2023-20872HIGHVMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device emulation.EPSS 0.9%CVE-2026-42369CRITICALGeoVision GV-VMS V20 WebCam Server stack overflow vulnerabilityEPSS 0.9%CVE-2022-27184HIGHHorner Automation Cscape CsfontEPSS 0.9%CVE-2025-53367HIGHDjVuLibre OOB-Write Vulnerability in MMRDecoderEPSS 0.9%CVE-2023-34623HIGHAn issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uEPSS 0.9%CVE-2026-5067CRITICALOut-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-KeyEPSS 0.9%CVE-2024-32760MEDIUMNGINX HTTP/3 QUIC vulnerabilityEPSS 0.9%CVE-2021-27623MEDIUMSAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing sEPSS 0.9%CVE-2022-40874HIGHTenda AX1803 v1.0.0.1 was discovered to contain a heap overflow vulnerability in the GetParentControlInfo function, which can cause a denialEPSS 0.9%CVE-2024-22660CRITICALTOTOLINK_A3700R_V9.1.2u.6165_20211012has a stack overflow vulnerability via setLanguageCfgEPSS 0.9%CVE-2022-22751HIGHMozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve EPSS 0.9%CVE-2024-22662CRITICALTOTOLINK A3700R_V9.1.2u.6165_20211012 has a stack overflow vulnerability via setParentalRulesEPSS 0.9%CVE-2022-40875HIGHTenda AX1803 v1.0.0.1 was discovered to contain a heap overflow in the function GetParentControlInfo.EPSS 0.9%CVE-2022-36086HIGHlinked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`EPSS 0.9%CVE-2026-54410HIGHnanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length FieldEPSS 0.9%CVE-2026-48686CRITICALFastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI (Network Layer Reachability Information) dEPSS 0.9%