Fallos del tipo CWE-787
5145 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.
Ejemplo
Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.
Cómo mitigar
Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.
CVE-2021-38479MEDIUMAUVESY VersiondogEPSS 0.9%CVE-2022-43250MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_0_0_fallback_16 in fallback-motion.cc. This vulnEPSS 0.9%CVE-2022-43249MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_hv_fallback<unsigned short> in fallback-motion.cEPSS 0.9%CVE-2022-43239MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_chroma<unsigned short> in motion.cc. This vulnerabilitEPSS 0.9%CVE-2022-43245MEDIUMLibde265 v1.0.8 was discovered to contain a segmentation violation via apply_sao_internal<unsigned short> in sao.cc. This vulnerability alloEPSS 0.9%CVE-2022-43248MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_weighted_pred_avg_16_fallback in fallback-motion.cc. EPSS 0.9%CVE-2022-43240MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_qpel_h_2_v_1_sse in sse-motion.cc. This EPSS 0.9%CVE-2023-29462HIGHRockwell Automation Arena Simulation Software Remote Code Execution VulnerabilityEPSS 0.9%CVE-2022-43252MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_16_fallback in fallback-motion.cc. This vulnerabEPSS 0.9%CVE-2022-43253MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_unweighted_pred_16_fallback in fallback-motion.cc. ThEPSS 0.9%CVE-2022-43244MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. EPSS 0.9%CVE-2022-43241MEDIUMLibde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_v_3_8_sse in sse-motion.cc. This vulnerability allows aEPSS 0.9%CVE-2022-43243MEDIUMLibde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_weighted_pred_avg_8_sse in sse-motion.cc. ThiEPSS 0.9%CVE-2022-28069HIGHA heap buffer overflow in vax_opfunction in radare2 5.4.2 and 5.4.0.EPSS 0.9%CVE-2022-43260CRITICALTenda AC18 V15.03.05.19(6318) was discovered to contain a stack overflow via the time parameter in the fromSetSysTime function.EPSS 0.9%CVE-2025-29385CRITICALIn Tenda AC9 v1.0 V15.03.05.14_multi, the cloneType parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead EPSS 0.9%CVE-2025-29386CRITICALIn Tenda AC9 v1.0 V15.03.05.14_multi, the mac parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remEPSS 0.9%CVE-2023-48945HIGHA stack overflow in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.EPSS 0.9%CVE-2022-38477HIGHMozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firefox ESR 102.1. Some oEPSS 0.9%CVE-2024-41593CRITICALDrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byteEPSS 0.9%