Fallos del tipo CWE-787

5859 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2026-86971MEDIUMAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and EPSS 0.6%CVE-2026-33816CRITICALCVE-2026-33816 in github.com/jackc/pgxEPSS 0.6%CVE-2026-75614HIGHASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)EPSS 0.6%CVE-2024-9248HIGHFoxit PDF Reader PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.6%CVE-2022-41307HIGHA maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by reEPSS 0.6%CVE-2022-40641HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.6%CVE-2022-40653HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.6%CVE-2022-40644HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.6%CVE-2023-51743MEDIUMBuffer Overflow vulnerability in Skyworth RouterEPSS 0.6%CVE-2023-51742MEDIUMBuffer Overflow vulnerability in Skyworth RouterEPSS 0.6%CVE-2022-40652HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.6%CVE-2023-24056MEDIUMIn pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuEPSS 0.6%CVE-2022-40654HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.6%CVE-2025-42877HIGHMemory Corruption vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content ServerEPSS 0.6%CVE-2023-32158HIGHPDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.6%CVE-2022-35939HIGHOut of bounds write in `scatter_nd` op in TensorFlow LiteEPSS 0.6%CVE-2025-20682CRITICALIn wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilegEPSS 0.6%CVE-2025-0910HIGHPDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-20683CRITICALIn wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilegEPSS 0.6%CVE-2024-5695CRITICALIf an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assertion could have been tEPSS 0.6%