Fallos del tipo CWE-787

5843 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2022-28826HIGHAdobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.2%CVE-2022-30656HIGHAdobe InCopy PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.2%CVE-2021-39829HIGHAdobe FrameMaker PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.2%CVE-2025-21043HIGHOut-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.EPSS 2.2%KEVCVE-2021-34897HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.2%CVE-2021-34903HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.2%CVE-2021-34914HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.2%CVE-2021-39831HIGHAdobe FrameMaker PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.2%CVE-2024-0741MEDIUMAn out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerabilEPSS 2.2%CVE-2022-2853HIGHHeap buffer overflow in Downloads in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker who had compromised the rendEPSS 2.1%CVE-2021-46818HIGHAdobe Media Encoder M4A file memory corruption vulnerability could lead to remote code executionEPSS 2.1%CVE-2021-46604HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2021-46583HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2018-17927—In Delta Industrial Automation TPEditor, TPEditor Versions 1.90 and prior, multiple out-of-bounds write vulnerabilities may be exploited by EPSS 2.1%CVE-2021-34899HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2021-34940HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2021-34898HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2023-6816CRITICALXorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointerEPSS 2.1%CVE-2023-21609HIGHAdobe Acrobat Reader DC AcroForm Annotation Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2023-26395HIGHAdobe Acrobat parsing PDF Out-of-bounds Write Arbitrary code execution EPSS 2.1%