Falhas do tipo CWE-787

5.860 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2025-53844HIGHA out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allowEPSS 0.6%CVE-2020-14331—A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the EPSS 0.6%CVE-2025-20727HIGHIn Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege, if a UE EPSS 0.6%CVE-2024-22667HIGHVim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is paEPSS 0.6%CVE-2020-13879CRITICALIrfanView B3D PlugIns before version 4.56 has a B3d.dll!+214f heap-based out-of-bounds write.EPSS 0.6%CVE-2022-39805—Due to lack of proper memory management, when a victim opens a manipulated Computer Graphics Metafile (.cgm, CgmTranslator.exe) file receiveEPSS 0.6%CVE-2026-88378CRITICALQuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().EPSS 0.6%CVE-2020-13878CRITICALIrfanView B3D PlugIns before version 4.56 has a B3d.dll!+27ef heap-based out-of-bounds write.EPSS 0.6%CVE-2026-119777HIGHGstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parserEPSS 0.6%CVE-2026-112334MEDIUMWazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.confEPSS 0.6%CVE-2020-13880CRITICALIrfanView B3D PlugIns before version 4.56 has a B3d.dll!+1cbf heap-based out-of-bounds write.EPSS 0.6%CVE-2018-16880MEDIUMA flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions,EPSS 0.6%CVE-2026-79048HIGHOut of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrarEPSS 0.6%CVE-2026-8946HIGHIncorrect boundary conditions in the Audio/Video: Web Codecs componentEPSS 0.6%CVE-2024-20068MEDIUMIn modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional EPSS 0.6%CVE-2019-25478HIGHGetGo Download Manager 6.2.2.3300 Buffer Overflow DoSEPSS 0.6%CVE-2025-30276MEDIUMQsync CentralEPSS 0.6%CVE-2025-43237CRITICALAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.6. An app may be able to cEPSS 0.6%CVE-2022-45496HIGHBuffer overflow vulnerability in function json_parse_string in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (NovembEPSS 0.6%CVE-2026-18828MEDIUMVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.6%