Fallos del tipo CWE-787

5846 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2022-35058MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b05ce.EPSS 0.9%CVE-2022-35053MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x61731f.EPSS 0.9%CVE-2022-35049MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b03b5.EPSS 0.9%CVE-2022-35052MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b84b1.EPSS 0.9%CVE-2026-88165HIGHWindows Active Directory Domain Services Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-7829HIGHUltraVNC repeater authenticated out-of-bounds write in rule parser via oversized tokenEPSS 0.9%CVE-2022-1041HIGHOut-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioningEPSS 0.9%CVE-2022-27653—A vulnerability has been identified in Simcenter Femap (All versions < V2022.2). The affected application contains an out of bounds write paEPSS 0.9%CVE-2022-2043HIGHMOXA NPort 5110 Out-of-bounds WriteEPSS 0.9%CVE-2024-12547HIGHTungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.9%CVE-2022-3043HIGHHeap buffer overflow in Screen Capture in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user tEPSS 0.8%CVE-2024-29218HIGHOut-of-bounds write vulnerability exists in KV STUDIO Ver.11.64 and earlier, KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver.6.EPSS 0.8%CVE-2024-3157HIGHOut of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU prEPSS 0.8%CVE-2023-30372CRITICALIn Tenda AC15 V15.03.05.19, The function "xkjs_ver32" contains a stack-based buffer overflow vulnerability.EPSS 0.8%CVE-2023-30373CRITICALIn Tenda AC15 V15.03.05.19, the function "xian_pppoe_user" contains a stack-based buffer overflow vulnerability.EPSS 0.8%CVE-2023-34613HIGHAn issue was discovered sojo thru 1.1.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uEPSS 0.8%CVE-2023-30370CRITICALIn Tenda AC15 V15.03.05.19, the function GetValue contains a stack-based buffer overflow vulnerability.EPSS 0.8%CVE-2023-34614HIGHAn issue was discovered jmarsden/jsonij thru 0.5.2 allows attackers to cause a denial of service or other unspecified impacts via crafted obEPSS 0.8%CVE-2022-1238HIGHOut-of-bounds Write in libr/bin/format/ne/ne.c in radareorg/radare2EPSS 0.8%CVE-2022-23560HIGHRead and Write outside of bounds in TFLiteEPSS 0.8%