Fallos del tipo CWE-787

5843 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2023-24958HIGHIBM TS7700 Management Interface command injectionEPSS 1.1%CVE-2026-116785CRITICALFreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handlingEPSS 1.1%CVE-2021-21257HIGHOut-of-bounds write in RPL-Classic and RPL-LiteEPSS 1.1%CVE-2023-24098HIGHTrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url EPSS 1.1%CVE-2023-24097HIGHTrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url EPSS 1.1%CVE-2022-26769HIGHA memory corruption issue was addressed with improved input validation. This issue is fixed in Security Update 2022-004 Catalina, macOS MontEPSS 1.1%CVE-2025-29909HIGHCryptoLib's Crypto_TC_ApplySecurity() Has a Heap Buffer Overflow VulnerabilityEPSS 1.1%CVE-2022-45640HIGHTenda Tenda AC6V1.0 V15.03.05.19 is affected by buffer overflow. Causes a denial of service (local).EPSS 1.1%CVE-2019-5188HIGHA code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directorEPSS 1.1%CVE-2022-2598MEDIUMOut-of-bounds Write to API in vim/vimEPSS 1.1%CVE-2024-22852CRITICALD-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the function genacgi_main. This vulnerability allows aEPSS 1.1%CVE-2021-22683—Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to crEPSS 1.1%CVE-2023-1810HIGHHeap buffer overflow in Visuals in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who had compromised the renderer process tEPSS 1.1%CVE-2023-33659HIGHA heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nmq_subinfo_decode(EPSS 1.1%CVE-2022-3725MEDIUMCrash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture fileEPSS 1.1%CVE-2023-27019CRITICALTenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the sub_458FBC function. This vulnerability allows aEPSS 1.1%CVE-2023-27018CRITICALTenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the sub_45EC1C function. This vulnerability allows aEPSS 1.1%CVE-2023-27013CRITICALTenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the get_parentControl_list_Info function. This vulneEPSS 1.1%CVE-2023-27021CRITICALTenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the formSetFirewallCfg function. This vulnerability EPSS 1.1%CVE-2023-27020CRITICALTenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the saveParentControlInfo function. This vulnerabiliEPSS 1.1%