Fallos del tipo CWE-788

147 resultados

Acesso de memória além do limite do buffer

A aplicação tenta acessar dados em um endereço de memória que está fora dos limites de um buffer alocado. Isso ocorre quando o código não valida corretamente o tamanho ou índice antes de ler/escrever, permitindo leitura de dados sensíveis ou corrupção de memória adjacente.

Ejemplo

Um servidor processa um pacote de rede e copia dados para um array de 256 bytes sem verificar o tamanho real do pacote. Se o pacote tiver 500 bytes, a cópia escreve 244 bytes além do buffer, sobrescrevendo variáveis locais ou dados de controle da pilha.

Cómo mitigar

Sempre validar e limitar o tamanho de leitura/escrita aos limites conhecidos do buffer antes de acessá-lo. Use funções seguras (como `strncpy` em C, ou linguagens com gerenciamento automático de memória), ou implemente verificações explícitas de limites e índices.

CVE-2021-45067MEDIUMAdobe Acrobat Reader Memory Corruption could lead to Information DisclosureEPSS 3.5%CVE-2021-36015HIGHAdobe Media Encoder Memory Corruption Could Lead To Remote Code ExecutionEPSS 3.5%CVE-2021-35996HIGHAdobe After Effects Memory Corruption Could Lead To Arbitrary Code ExecutionEPSS 3.2%CVE-2021-36052HIGHXMPToolkit SDK ImportTIFF_CheckStandardMapping Memory CorruptionEPSS 3.2%CVE-2019-8265—UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETPIXELS macro in VNC client codeEPSS 3.1%CVE-2019-8264—UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside Ultra2 decoder, which can potentially result in code execEPSS 3.1%CVE-2020-9727HIGHOut-of-bounds memory access could lead to code executionEPSS 3.1%CVE-2021-44179HIGHAdobe Dimension GIF File Parsing Memory Corruption Remote Code Execution VulnerabilityEPSS 3.1%CVE-2021-36017HIGHAdobe After Effects PDF File Parsing Memory Corruption Remote Code Execution VulnerabilityEPSS 3.0%CVE-2021-36009HIGHAdobe Illustrator PDF File Parsing Memory Corruption Remote Code Execution VulnerabilityEPSS 3.0%CVE-2019-8266—UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnection::Copybuffer functEPSS 2.8%CVE-2020-24414HIGHAdobe Illustrator Memory Corruption VulnerabilityEPSS 2.8%CVE-2020-24412HIGHAdobe Illustrator Memory Corruption VulnerabilityEPSS 2.8%CVE-2020-24413HIGHAdobe Illustrator Memory Corruption VulnerabilityEPSS 2.8%CVE-2020-9730HIGHOut-of-bounds memory access could lead to code executionEPSS 2.7%CVE-2020-9729HIGHOut-of-bounds memory access could lead to code executionEPSS 2.7%CVE-2020-9728HIGHOut-of-bounds memory access could lead to code executionEPSS 2.7%CVE-2020-24415HIGHAdobe Illustrator Memory Corruption VulnerabilityEPSS 2.7%CVE-2021-40733HIGHAdobe Animate Memory Corruption Could Lead To Arbitrary Code ExecutionEPSS 2.6%CVE-2021-27384CRITICALA vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 UpdatEPSS 2.6%