Falhas do tipo CWE-787

5.841 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2020-8849HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interactionEPSS 6.0%CVE-2020-8850HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interactionEPSS 6.0%CVE-2024-30279HIGHZDI-CAN-22887: Adobe Acrobat Reader DC JPEG2000 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 5.9%CVE-2019-17139HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interacEPSS 5.8%CVE-2022-39173HIGHIn wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly rEPSS 5.8%CVE-2021-21098HIGHAdobe InDesign PCX file parsing out-of-bounds write vulnerability could lead to remote code executionEPSS 5.8%CVE-2021-21099HIGHAdobe InDesign PCX file parsing out-of-bounds write vulnerability could lead to remote code executionEPSS 5.8%CVE-2022-45460CRITICALMultiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.0000EPSS 5.7%CVE-2022-32917HIGHThe issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS BigEPSS 5.6%KEVCVE-2020-3765CRITICALAdobe After Effects versions 16.1.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary cEPSS 5.6%CVE-2023-3595CRITICALRockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code ExecutionEPSS 5.5%CVE-2019-17144HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interacEPSS 5.5%CVE-2021-28664HIGHThe Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieEPSS 5.5%KEVCVE-2020-9562HIGHAdobe Bridge versions 10.0.1 and earlier version have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code exEPSS 5.4%CVE-2023-40547HIGHShim: rce in http boot support may lead to secure boot bypassEPSS 5.4%CVE-2020-9555HIGHAdobe Bridge versions 10.0.1 and earlier version have a stack-based buffer overflow vulnerability. Successful exploitation could lead to arbEPSS 5.3%CVE-2020-9563HIGHAdobe Bridge versions 10.0.1 and earlier version have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code exEPSS 5.3%CVE-2026-2045HIGHGIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 5.3%CVE-2025-11187MEDIUMImproper validation of PBMAC1 parameters in PKCS#12 MAC verificationEPSS 5.2%CVE-2021-30900HIGHAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and EPSS 5.2%KEV