Falhas do tipo CWE-787

5.860 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2026-70461HIGHrsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from EntryEPSS 0.6%CVE-2025-27105LOWAugAssign evaluation order causing OOB write within the object in VyperEPSS 0.6%CVE-2025-27598HIGHOut-of-bounds Write in SixLabors ImageSharpEPSS 0.6%CVE-2023-49351CRITICALA stack-based buffer overflow vulnerability in /bin/webs binary in Edimax BR6478AC V2 firmware veraion v1.23 allows attackers to overwrite oEPSS 0.6%CVE-2026-95508HIGHLibslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtuEPSS 0.6%CVE-2024-42952HIGHTenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromqossetting function. This vulnerabEPSS 0.6%CVE-2024-36260HIGHArkcompiler Ets Runtime has an out-of-bounds write vulnerabilityEPSS 0.6%CVE-2024-36243HIGHArkcompiler Ets Runtime has an out-of-bounds read vulnerabilityEPSS 0.6%CVE-2023-4020CRITICALUnvalidated input in Silicon Labs PSA Attestation service leads to secure memory access from non-secure memoryEPSS 0.6%CVE-2026-81625HIGHStack buffer overflow in Greenbone OS and openvas-scannerEPSS 0.6%CVE-2022-41168—Due to lack of proper memory management, when a victim opens a manipulated CATIA5 Part (.catpart, CatiaTranslator.exe) file received from unEPSS 0.6%CVE-2022-41177—Due to lack of proper memory management, when a victim opens a manipulated Iges Part and Assembly (.igs, .iges, CoreCadTranslator.exe) file EPSS 0.6%CVE-2022-41170—Due to lack of proper memory management, when a victim opens a manipulated CATIA4 Part (.model, CatiaTranslator.exe) file received from untrEPSS 0.6%CVE-2022-41172—Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrustedEPSS 0.6%CVE-2022-41167—Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dwg, TeighaTranslator.exe) file received from untrustedEPSS 0.6%CVE-2022-41179—Due to lack of proper memory management, when a victim opens a manipulated Jupiter Tesselation (.jt, JtTranslator.exe) file received from unEPSS 0.6%CVE-2022-0843HIGHMozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 97. Some of these bugsEPSS 0.6%CVE-2026-48686CRITICALFastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI (Network Layer Reachability Information) dEPSS 0.6%CVE-2025-20182HIGHCisco Adaptive Security Appliance Software, Firepower Threat Defense Software and IOS XE Software IKEv2 Denial of Service VulnerabilityEPSS 0.6%CVE-2025-53844HIGHA out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allowEPSS 0.6%