Fallos del tipo CWE-787

5135 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2020-7465—The L2TP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted L2TP control packet with AVP Q.931 CausEPSS 3.0%CVE-2022-23200HIGHAdobe After Effects 3GP File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.0%CVE-2022-27798HIGHAdobe Acrobat Reader DC zoomType Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.0%CVE-2022-27788HIGHAdobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.0%CVE-2020-16213—Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user EPSS 3.0%CVE-2021-21048HIGHAdobe Photoshop Buffer Overflow Vulnerability Could Lead To Remote Code Execution VulnerabilityEPSS 3.0%CVE-2021-28605HIGHAdobe After Effects memory corruption could lead to arbitrary code executionEPSS 3.0%CVE-2021-31452HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interactioEPSS 2.9%CVE-2021-37404—Heap buffer overflow in libhdfs native libraryEPSS 2.9%CVE-2022-24058HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User inteEPSS 2.9%CVE-2018-10880MEDIUMLinux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in eEPSS 2.9%CVE-2017-9938—A vulnerability was discovered in Siemens SIMATIC Logon (All versions before V1.6) that could allow specially crafted packets sent to the SIEPSS 2.9%CVE-2020-17529—Apache NuttX (incubating) Out of Bound Write from invalid fragmentation offset value specified in the IP headerEPSS 2.9%CVE-2025-2761HIGHGIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.9%CVE-2021-21067HIGHAdobe Photoshop CoolType arbitrary stack manipulation in Type 1/Multiple MasterEPSS 2.9%CVE-2021-31472HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interactioEPSS 2.8%CVE-2021-31442HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interactioEPSS 2.8%CVE-2020-9565HIGHAdobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary EPSS 2.8%CVE-2020-9564HIGHAdobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary EPSS 2.8%CVE-2020-9559HIGHAdobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary EPSS 2.8%