Fallos del tipo CWE-787

5846 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2022-23574HIGHOut of bounds read and write in TensorflowEPSS 0.8%CVE-2026-42944HIGHHeap overflow with multiple NSID, COOKIE, PADDING EDNS optionsEPSS 0.8%CVE-2026-114550HIGHlibwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.8%CVE-2023-32886HIGHIn Modem IMS SMS UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service withEPSS 0.8%CVE-2023-1801—The SMB protocol decoder in tcpdump version 4.99.3 can perform an out-of-bounds write when decoding a crafted network packet.EPSS 0.8%CVE-2026-86510CRITICALD-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds writeEPSS 0.8%CVE-2026-82680HIGHD-Link DSM-G600 Multipart load_file.cgi out-of-bounds writeEPSS 0.8%CVE-2021-44443—A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected prEPSS 0.8%CVE-2021-44446—A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK library in affected prEPSS 0.8%CVE-2021-44441—A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected prEPSS 0.8%CVE-2021-44430—A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected prEPSS 0.8%CVE-2021-44434—A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected prEPSS 0.8%CVE-2021-42024—A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < 2021.3.1). The starview+.exe application lacks proper valiEPSS 0.8%CVE-2021-44438—A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected prEPSS 0.8%CVE-2021-44437—A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected prEPSS 0.8%CVE-2021-44449—A vulnerability has been identified in JT Utilities (All versions < V12.8.1.1), JTTK (All versions < V10.8.1.1). JTTK library in affected prEPSS 0.8%CVE-2023-27239CRITICALTenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the shareSpeed parameter at /goform/WifiGuestSet.EPSS 0.8%CVE-2022-1403HIGHDelta Electronics ASDA-Soft Out-of-bounds WriteEPSS 0.8%CVE-2018-25221CRITICALEChat Server 3.1 Buffer Overflow via chat.ghp username ParameterEPSS 0.8%CVE-2023-29584HIGHmp4v2 v2.0.0 was discovered to contain a heap buffer overflow via the MP4GetVideoProfileLevel function at /src/mp4.cpp.EPSS 0.8%