Fallos del tipo CWE-787
5843 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.
Ejemplo
Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.
Cómo mitigar
Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.
CVE-2022-43235MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_epel_pixels_8_sse in sse-motion.cc. ThisEPSS 1.1%CVE-2026-48095HIGHGHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocationEPSS 1.1%CVE-2023-26072HIGHAn issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 22EPSS 1.1%CVE-2023-26073HIGHAn issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 22EPSS 1.1%CVE-2022-32793HIGHMultiple out-of-bounds write issues were addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, tEPSS 1.1%CVE-2022-43102CRITICALTenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the timeZone parameter in the fromSetSysTime function.EPSS 1.1%CVE-2022-43103CRITICALTenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the list parameter in the formSetQosBand function.EPSS 1.1%CVE-2022-43105CRITICALTenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function.EPSS 1.1%CVE-2022-43108CRITICALTenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function.EPSS 1.1%CVE-2022-43107CRITICALTenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function.EPSS 1.1%CVE-2022-43101CRITICALTenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.EPSS 1.1%CVE-2023-24799CRITICALD-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_48AF78 function. This vulnerability allows attackers toEPSS 1.1%CVE-2023-24798CRITICALD-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_475FB0 function. This vulnerability allows attackers toEPSS 1.1%CVE-2023-2929HIGHOut of bounds write in Swiftshader in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption EPSS 1.1%CVE-2022-32796HIGHA memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.5. An app may be able to exEPSS 1.1%CVE-2019-5094HIGHAn exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition cEPSS 1.1%CVE-2022-26771HIGHA memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 8.6, tvOS 15.5, iOS 15.5 and iPadOS 1EPSS 1.1%CVE-2024-32615CRITICALHDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5Z__nbit_decompress_one_byte in H5Znbit.c, caused by the earlier use oEPSS 1.1%CVE-2024-22086CRITICALhandle_request in http.c in cherry through 4b877df has an sscanf stack-based buffer overflow via a long URI, leading to remote code executioEPSS 1.1%CVE-2018-25254CRITICALNICO-FTP 3.0.1.19 Buffer Overflow SEHEPSS 1.1%