Falhas do tipo CWE-787

5.177 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2023-39498HIGHPDF-XChange Editor JPG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-34265HIGHFatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-34266HIGHFatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-34264HIGHFatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-34269HIGHFatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-34271HIGHFatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.4%CVE-2022-42939HIGHA malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerabEPSS 0.4%CVE-2023-34267HIGHFatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.4%CVE-2022-42944HIGHA malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by reaEPSS 0.4%CVE-2022-41844MEDIUMAn issue was discovered in Xpdf 4.04. There is a crash in XRef::fetch(int, int, Object*, int) in xpdf/XRef.cc, a different vulnerability thaEPSS 0.4%CVE-2022-42940HIGHA malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerabEPSS 0.4%CVE-2022-42936HIGHA malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by wrEPSS 0.4%CVE-2024-11520HIGHIrfanView ARW File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-54240HIGHlibde265: Pixel accessor signed integer overflow causes heap OOB read/writeEPSS 0.4%CVE-2024-11555HIGHIrfanView DXF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-11548HIGHIrfanView DWG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-32402HIGHAn Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the library by EPSS 0.4%CVE-2024-11554HIGHIrfanView DWG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-11550HIGHIrfanView DXF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-11549HIGHIrfanView DXF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.4%