Fallos del tipo CWE-787
5843 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.
Ejemplo
Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.
Cómo mitigar
Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.
CVE-2018-20249—In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref entries uEPSS 1.4%CVE-2026-85437CRITICALMOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String DecodersEPSS 1.4%CVE-2022-40962HIGHMozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugsEPSS 1.4%CVE-2022-42998CRITICALD-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the srcip parameter at /goform/form2IPQoSTcAdd.EPSS 1.4%CVE-2021-21703HIGHPHP-FPM memory access in root process leading to privilege escalationEPSS 1.4%CVE-2022-34286—A vulnerability has been identified in PADS Standard/Plus Viewer (All versions). The affected application contains an out of bounds write paEPSS 1.4%CVE-2022-34276—A vulnerability has been identified in PADS Standard/Plus Viewer (All versions). The affected application contains an out of bounds write paEPSS 1.4%CVE-2022-34275—A vulnerability has been identified in PADS Standard/Plus Viewer (All versions). The affected application contains an out of bounds write paEPSS 1.4%CVE-2022-34284—A vulnerability has been identified in PADS Standard/Plus Viewer (All versions). The affected application contains an out of bounds write paEPSS 1.4%CVE-2022-34273—A vulnerability has been identified in PADS Standard/Plus Viewer (All versions). The affected application contains an out of bounds write paEPSS 1.4%CVE-2022-34289—A vulnerability has been identified in PADS Standard/Plus Viewer (All versions). The affected application contains an out of bounds write paEPSS 1.4%CVE-2022-2288HIGHOut-of-bounds Write in vim/vimEPSS 1.4%CVE-2022-34274—A vulnerability has been identified in PADS Standard/Plus Viewer (All versions). The affected application contains an out of bounds write paEPSS 1.4%CVE-2021-31492HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2021-31484HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2021-31491HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2021-31487HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2021-31496HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2021-31490HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2021-31494HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%