Falhas do tipo CWE-787
5.133 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.
Exemplo
Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.
Como mitigar
Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).
CVE-2022-32917HIGHThe issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS BigEPSS 5.6%KEVCVE-2021-31473HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598. User interactioEPSS 5.6%CVE-2020-3765CRITICALAdobe After Effects versions 16.1.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary cEPSS 5.6%CVE-2023-3595CRITICALRockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code ExecutionEPSS 5.5%CVE-2019-17144HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interacEPSS 5.5%CVE-2023-40547HIGHShim: rce in http boot support may lead to secure boot bypassEPSS 5.4%CVE-2021-28664HIGHThe Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieEPSS 5.4%KEVCVE-2020-9562HIGHAdobe Bridge versions 10.0.1 and earlier version have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code exEPSS 5.3%CVE-2021-30900HIGHAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and EPSS 5.2%KEVCVE-2020-9555HIGHAdobe Bridge versions 10.0.1 and earlier version have a stack-based buffer overflow vulnerability. Successful exploitation could lead to arbEPSS 5.2%CVE-2020-9563HIGHAdobe Bridge versions 10.0.1 and earlier version have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code exEPSS 5.2%CVE-2020-14305—An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connectEPSS 5.2%CVE-2020-15629HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interacEPSS 5.1%CVE-2020-1910—A missing bounds check in WhatsApp for Android prior to v2.21.1.13 and WhatsApp Business for Android prior to v2.21.1.13 could have allowed EPSS 5.1%CVE-2022-22629HIGHA buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iEPSS 5.1%CVE-2020-10904HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interacEPSS 4.9%CVE-2020-10897HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interacEPSS 4.9%CVE-2020-36518HIGHjackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.EPSS 4.9%CVE-2020-10893HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interacEPSS 4.8%CVE-2020-3119HIGHCisco NX-OS Software Cisco Discovery Protocol Remote Code Execution VulnerabilityEPSS 4.8%