Fallos del tipo CWE-787
5142 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.
Ejemplo
Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.
Cómo mitigar
Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.
CVE-2024-29133MEDIUMApache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object treeEPSS 1.7%CVE-2021-21046LOWAcrobat Reader DC Buffer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 1.7%CVE-2018-14810—WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior parse files and pass invalidated uEPSS 1.7%CVE-2023-30800HIGHMikroTik RouterOS Web Interface Heap CorruptionEPSS 1.7%CVE-2024-23305CRITICALAn out-of-bounds write vulnerability exists in the BrainVisionMarker Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master EPSS 1.7%CVE-2021-41160MEDIUMImproper region checks in FreeRDP allow out of bound write to memoryEPSS 1.7%CVE-2021-34300—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_loader.dll liEPSS 1.7%CVE-2021-34331—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library EPSS 1.7%CVE-2021-34311—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Mono_loader.dll liEPSS 1.7%CVE-2021-34316—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The DL180CoolType.dll EPSS 1.7%CVE-2021-34291—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Gif_loader.dll libEPSS 1.7%CVE-2021-34310—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_loader.dll liEPSS 1.7%CVE-2021-34297—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll libEPSS 1.7%CVE-2021-34309—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_loader.dll liEPSS 1.7%CVE-2021-34314—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_loader.dll libEPSS 1.7%CVE-2021-34295—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Gif_loader.dll libEPSS 1.7%CVE-2021-34319—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_loader.dll libEPSS 1.7%CVE-2021-34293—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Gif_loader.dll libEPSS 1.7%CVE-2021-1445HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services VPN Denial of Service VulnerabilitiesEPSS 1.7%CVE-2021-1504HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services VPN Denial of Service VulnerabilitiesEPSS 1.7%