Falhas do tipo CWE-787
5.841 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.
Exemplo
Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.
Como mitigar
Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).
CVE-2021-28564HIGHAdobe Acrobat Reader out-of-bounds write vulnerability could lead to arbitrary code executionEPSS 3.5%CVE-2017-9634—Mitsubishi E-Designer, Version 7.52 Build 344 contains two code sections which may be exploited to allow an attacker to overwrite arbitrary EPSS 3.5%CVE-2026-87491HIGHOut of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox viaEPSS 3.5%KEVCVE-2022-42920—Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writingEPSS 3.5%CVE-2019-6759HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interactionEPSS 3.5%CVE-2019-6764HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interactiEPSS 3.5%CVE-2019-6760HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.16811. User interactionEPSS 3.5%CVE-2021-21101HIGHAdobe Illustrator TTF font parsing out-of-bounds write vulnerability could lead to remote code executionEPSS 3.5%CVE-2019-6755HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interactionEPSS 3.5%CVE-2019-6749HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. User interactiEPSS 3.5%CVE-2019-6750HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. User interactiEPSS 3.5%CVE-2019-6751HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6.779. User interEPSS 3.5%CVE-2021-28607HIGHAdobe After Effects heap corruption vulnerability could lead to arbitrary code executionEPSS 3.4%CVE-2019-3863HIGHA flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactivEPSS 3.4%CVE-2019-6747HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. User interactiEPSS 3.4%CVE-2019-6748HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. User interactiEPSS 3.4%CVE-2021-21038HIGHAcrobat Reader DC Out-Of-Bounds Write Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 3.4%CVE-2024-53104HIGHmedia: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_formatEPSS 3.4%KEVCVE-2020-27275—Delta Electronics DOPSoft Version 4.0.8.21 and prior is vulnerable to an out-of-bounds write while processing project files, which may allowEPSS 3.4%CVE-2020-17412HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaEPSS 3.4%