Fallos del tipo CWE-787

5155 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2026-62434MEDIUMPoD: Don't try to reclaim special pagesEPSS 0.5%CVE-2026-10849HIGHHeap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response bodyEPSS 0.5%CVE-2023-42753HIGHKernel: netfilter: potential slab-out-of-bound access due to integer underflowEPSS 0.5%CVE-2022-22088CRITICALInteger Overflow to Buffer Overflow in Bluetooth HOSTEPSS 0.5%CVE-2024-9121HIGHInappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out of bounds meEPSS 0.5%CVE-2025-20725HIGHIn ims service, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, ifEPSS 0.5%CVE-2022-46885HIGHMozilla developers Timothy Nikkel, Ashley Hale, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105. Some of theEPSS 0.5%CVE-2026-6679HIGHDTLS 1.3 ACK serialization heap buffer overflow via integer truncationEPSS 0.5%CVE-2024-20501HIGHMultiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could alEPSS 0.5%CVE-2024-20499HIGHMultiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could alEPSS 0.5%CVE-2023-0137HIGHHeap buffer overflow in Platform Apps in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed an attacker who convinced a user to instaEPSS 0.5%CVE-2023-0129HIGHHeap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a maliciEPSS 0.5%CVE-2026-93451MEDIUMsnappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methodsEPSS 0.5%CVE-2026-19642MEDIUMOut-of-bounds write in the Base64 decoder in Amazon aws-sdk-cppEPSS 0.5%CVE-2026-71263CRITICALFreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()EPSS 0.5%CVE-2024-22254HIGHOut-of-bounds write vulnerabilityEPSS 0.5%CVE-2024-36114HIGHDecompressors can crash the JVM and leak memory content in AircompressorEPSS 0.5%CVE-2026-17636HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.5%CVE-2024-20357MEDIUMA vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an EPSS 0.5%CVE-2025-41649HIGHWeidmueller: Out-of-Bounds Write Vulnerability in Industrial Ethernet SwitchesEPSS 0.5%