Fallos del tipo CWE-787

5843 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2023-2856MEDIUMVMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture fileEPSS 1.8%CVE-2025-9230CRITICALOut-of-bounds read & write in RFC 3211 KEK UnwrapEPSS 1.8%CVE-2024-25004HIGHKiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds checkEPSS 1.8%CVE-2019-1887HIGHCisco Unified Communications Manager Session Initiation Protocol Denial of Service VulnerabilityEPSS 1.8%CVE-2021-32988—FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitEPSS 1.8%CVE-2022-33183HIGHA vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a remote authenticaEPSS 1.8%CVE-2020-1894—A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone priorEPSS 1.8%CVE-2019-14906HIGHA flaw was found with the RHSA-2019:3950 erratum, where it did not fix the CVE-2019-13616 SDL vulnerability. This issue only affects Red HatEPSS 1.8%CVE-2023-23531HIGHThe issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. An app may be abEPSS 1.8%CVE-2021-21046LOWAcrobat Reader DC Buffer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 1.7%CVE-2021-3405—A flaw was found in libebml before 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and EbmlUnicodeString::ReEPSS 1.7%CVE-2021-34323—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library EPSS 1.7%CVE-2024-29133MEDIUMApache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object treeEPSS 1.7%CVE-2022-42058CRITICALTenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a stack overflow via the setRemoteWebManage function. This vulnEPSS 1.7%CVE-2018-14810—WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior parse files and pass invalidated uEPSS 1.7%CVE-2023-30800HIGHMikroTik RouterOS Web Interface Heap CorruptionEPSS 1.7%CVE-2021-43754HIGHAdobe Prelude Corruption could lead to Arbitrary code executionEPSS 1.7%CVE-2024-23305CRITICALAn out-of-bounds write vulnerability exists in the BrainVisionMarker Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master EPSS 1.7%CVE-2025-34105CRITICALDiskBoss Enterprise Stack-Based Buffer Overflow RCEEPSS 1.7%CVE-2021-41160MEDIUMImproper region checks in FreeRDP allow out of bound write to memoryEPSS 1.7%