Fallos del tipo CWE-787

5860 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2025-53844HIGHA out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allowEPSS 0.6%CVE-2020-14331—A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the EPSS 0.6%CVE-2025-20727HIGHIn Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege, if a UE EPSS 0.6%CVE-2024-22667HIGHVim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is paEPSS 0.6%CVE-2020-13879CRITICALIrfanView B3D PlugIns before version 4.56 has a B3d.dll!+214f heap-based out-of-bounds write.EPSS 0.6%CVE-2022-39805—Due to lack of proper memory management, when a victim opens a manipulated Computer Graphics Metafile (.cgm, CgmTranslator.exe) file receiveEPSS 0.6%CVE-2026-88378CRITICALQuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().EPSS 0.6%CVE-2020-13878CRITICALIrfanView B3D PlugIns before version 4.56 has a B3d.dll!+27ef heap-based out-of-bounds write.EPSS 0.6%CVE-2026-119777HIGHGstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parserEPSS 0.6%CVE-2026-112334MEDIUMWazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.confEPSS 0.6%CVE-2020-13880CRITICALIrfanView B3D PlugIns before version 4.56 has a B3d.dll!+1cbf heap-based out-of-bounds write.EPSS 0.6%CVE-2018-16880MEDIUMA flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions,EPSS 0.6%CVE-2026-79048HIGHOut of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrarEPSS 0.6%CVE-2026-8946HIGHIncorrect boundary conditions in the Audio/Video: Web Codecs componentEPSS 0.6%CVE-2024-20068MEDIUMIn modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional EPSS 0.6%CVE-2019-25478HIGHGetGo Download Manager 6.2.2.3300 Buffer Overflow DoSEPSS 0.6%CVE-2025-30276MEDIUMQsync CentralEPSS 0.6%CVE-2025-43237CRITICALAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.6. An app may be able to cEPSS 0.6%CVE-2022-45496HIGHBuffer overflow vulnerability in function json_parse_string in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (NovembEPSS 0.6%CVE-2026-18828MEDIUMVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.6%