Falhas do tipo CWE-787

5.862 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2023-21054HIGHIn EUTRAN_LCS_ConvertLCS_MOLRReq of LPP_CommonUtil.c, there is a possible out of bounds write due to a logic error in the code. This could lEPSS 0.5%CVE-2024-33008MEDIUMMemory Corruption vulnerability in SAP Replication ServerEPSS 0.5%CVE-2026-43125CRITICALdlm: validate length in dlm_search_rsb_treeEPSS 0.5%CVE-2026-42369CRITICALGeoVision GV-VMS V20 WebCam Server stack overflow vulnerabilityEPSS 0.5%CVE-2020-1751MEDIUMAn out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtraceEPSS 0.5%CVE-2023-0129HIGHHeap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a maliciEPSS 0.5%CVE-2022-37234HIGHNetgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary iEPSS 0.5%CVE-2022-28668HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.9.2. User interaEPSS 0.5%CVE-2024-56406HIGHPerl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytesEPSS 0.5%CVE-2026-58154CRITICALApache Traffic Server: Memory-safety errors in MIME and header parsingEPSS 0.5%CVE-2026-121368HIGHSecurity Advisory 0206EPSS 0.5%CVE-2024-5844HIGHHeap buffer overflow in Tab Strip in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory read EPSS 0.5%CVE-2023-0137HIGHHeap buffer overflow in Platform Apps in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed an attacker who convinced a user to instaEPSS 0.5%CVE-2026-62817HIGHWindows DNS Server Remote Code Execution VulnerabilityEPSS 0.5%CVE-2023-51597HIGHKofax Power PDF U3D File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.5%CVE-2022-24893HIGHEspressif Bluetooth Mesh Stack Vulnerable to Out-of-bounds Write leading to memory buffer corruptionEPSS 0.5%CVE-2026-55827HIGHFreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decodeEPSS 0.5%CVE-2026-123615HIGHimgproxy before 4.0.17 Out-of-Bounds Write in ICO LoaderEPSS 0.5%CVE-2023-27343HIGHPDF-XChange Editor EMF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.5%CVE-2023-27345HIGHPDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.5%