Falhas do tipo CWE-787

5.862 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2026-27890HIGHFirebird has Pre-Auth DOS when Processing Out of Order CNCT_specific_data SegmentsEPSS 0.5%CVE-2026-59685HIGHApache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEMEPSS 0.5%CVE-2026-56153HIGHApache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_charEPSS 0.5%CVE-2026-9698HIGHDBI versions before 1.648 for Perl saved errors in a limited-sized bufferEPSS 0.5%CVE-2026-65395MEDIUMAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOSEPSS 0.5%CVE-2025-41238CRITICALPVSCSI heap-overflow vulnerabilityEPSS 0.5%CVE-2026-63638HIGHOpenImageIO: Cineon invalid bit depth heap out-of-bounds writeEPSS 0.5%CVE-2025-41237CRITICALVMCI integer-underflow vulnerabilityEPSS 0.5%CVE-2024-49200MEDIUMAn issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential DXE memory corruptionEPSS 0.5%CVE-2021-3546—An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including EPSS 0.5%CVE-2026-84496MEDIUMAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2.EPSS 0.5%CVE-2024-46274HIGHcute_png v1.05 was discovered to contain a heap buffer overflow via the cp_stored() function at cute_png.h.EPSS 0.5%CVE-2024-46263HIGHcute_png v1.05 was discovered to contain a stack overflow via the cp_dynamic() function at cute_png.h.EPSS 0.5%CVE-2026-87438CRITICALOut of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outsiEPSS 0.5%CVE-2024-46264HIGHcute_png v1.05 was discovered to contain a heap buffer overflow via the cp_find() function at cute_png.h.EPSS 0.5%CVE-2026-85050CRITICALOut of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outsiEPSS 0.5%CVE-2026-87638CRITICALOut of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outsideEPSS 0.5%CVE-2024-46276HIGHcute_png v1.05 was discovered to contain a heap buffer overflow via the cp_chunk() function at cute_png.h.EPSS 0.5%CVE-2024-46259HIGHcute_png v1.05 was discovered to contain a heap buffer overflow via the cp_unfilter() function at cute_png.h.EPSS 0.5%CVE-2024-46267HIGHcute_png v1.05 was discovered to contain a heap buffer overflow via the cp_block() function at cute_png.h.EPSS 0.5%