Fallos del tipo CWE-787

5102 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2021-36066HIGHAdobe Photoshop U3D File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.2%CVE-2021-35993HIGHAdobe After Effects PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.2%CVE-2022-44255CRITICALTOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post data.EPSS 2.2%CVE-2021-45053HIGHAdobe InCopy JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.2%CVE-2021-45058HIGHAdobe InDesign JPEG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.2%CVE-2021-45057HIGHAdobe InDesign JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.2%CVE-2026-11645HIGHOut of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sanEPSS 2.2%KEVCVE-2020-9819MEDIUMA memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOSEPSS 2.2%KEVCVE-2021-39831HIGHAdobe FrameMaker PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.2%CVE-2022-42808CRITICALAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 16.1, iOS 16.1 and iPadOS 16, macOS VeEPSS 2.2%CVE-2024-0741MEDIUMAn out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerabilEPSS 2.2%CVE-2025-25050HIGHDell ControlVault3/ControlVault3 Plus cv_upgrade_sensor_firmware out-of-bounds write vulnerabilityEPSS 2.1%CVE-2022-44259HIGHTOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter week, sTime, and eTime in the setParentalEPSS 2.1%CVE-2022-28847HIGHAdobe Bridge Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-44257HIGHTOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter pppoeUser in the setOpModeCfg function.EPSS 2.1%CVE-2022-44256HIGHTOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter lang in the setLanguageCfg function.EPSS 2.1%CVE-2022-28848HIGHAdobe Bridge PCX Out-of-bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-44254HIGHTOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter text in the setSmsCfg function.EPSS 2.1%CVE-2022-44260HIGHTOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter sPort/ePort in the setIpPortFilterRules fEPSS 2.1%CVE-2022-28846HIGHAdobe Bridge SVG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%