Fallos del tipo CWE-787
5133 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.
Ejemplo
Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.
Cómo mitigar
Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.
CVE-2022-32917HIGHThe issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS BigEPSS 5.6%KEVCVE-2021-31473HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598. User interactioEPSS 5.6%CVE-2020-3765CRITICALAdobe After Effects versions 16.1.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary cEPSS 5.6%CVE-2023-3595CRITICALRockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code ExecutionEPSS 5.5%CVE-2019-17144HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interacEPSS 5.5%CVE-2023-40547HIGHShim: rce in http boot support may lead to secure boot bypassEPSS 5.4%CVE-2021-28664HIGHThe Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieEPSS 5.4%KEVCVE-2020-9562HIGHAdobe Bridge versions 10.0.1 and earlier version have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code exEPSS 5.3%CVE-2021-30900HIGHAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and EPSS 5.2%KEVCVE-2020-9555HIGHAdobe Bridge versions 10.0.1 and earlier version have a stack-based buffer overflow vulnerability. Successful exploitation could lead to arbEPSS 5.2%CVE-2020-9563HIGHAdobe Bridge versions 10.0.1 and earlier version have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code exEPSS 5.2%CVE-2020-14305—An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connectEPSS 5.2%CVE-2020-15629HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interacEPSS 5.1%CVE-2020-1910—A missing bounds check in WhatsApp for Android prior to v2.21.1.13 and WhatsApp Business for Android prior to v2.21.1.13 could have allowed EPSS 5.1%CVE-2022-22629HIGHA buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iEPSS 5.1%CVE-2020-10904HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interacEPSS 4.9%CVE-2020-10897HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interacEPSS 4.9%CVE-2020-36518HIGHjackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.EPSS 4.9%CVE-2020-10893HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interacEPSS 4.8%CVE-2020-3119HIGHCisco NX-OS Software Cisco Discovery Protocol Remote Code Execution VulnerabilityEPSS 4.8%