Fallos del tipo CWE-787
5729 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.
Ejemplo
Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.
Cómo mitigar
Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.
CVE-2023-41727CRITICALAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofEPSS 36.4%CVE-2018-17480HIGHExecution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.35EPSS 35.6%KEVCVE-2025-21042HIGHOut-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.EPSS 35.6%KEVCVE-2015-2387HIGHATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,EPSS 34.9%KEVCVE-2016-5198HIGHV8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect oEPSS 34.2%KEVCVE-2018-13383MEDIUMA heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxEPSS 32.5%KEVCVE-2022-4135CRITICALHeap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to pEPSS 31.9%KEVCVE-2020-0968HIGHA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripEPSS 30.7%KEVCVE-2017-0222HIGHA remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorEPSS 29.6%KEVCVE-2018-8653HIGHA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripEPSS 29.6%KEVCVE-2025-14733CRITICALWatchGuard Firebox iked Out of Bounds Write VulnerabilityEPSS 29.4%KEVCVE-2020-12011—A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code executiEPSS 29.2%CVE-2021-30807HIGHA memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14EPSS 28.8%KEVCVE-2017-0149HIGHMicrosoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vEPSS 28.5%KEVCVE-2022-37969HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 28.5%KEVCVE-2023-52755CRITICALksmbd: fix slab out of bounds write in smb_inherit_dacl()EPSS 28.1%CVE-2025-27363HIGHAn out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parseEPSS 27.8%KEVCVE-2023-4355HIGHOut of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption vEPSS 27.7%CVE-2021-3490HIGHLinux kernel eBPF bitwise ops ALU32 bounds trackingEPSS 27.4%CVE-2026-86950HIGHAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 EPSS 26.2%KEV