Falhas do tipo CWE-787

5.841 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2023-42789CRITICALA out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortEPSS 3.3%CVE-2022-32894HIGHAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS MontereEPSS 3.3%KEVCVE-2021-20294—A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could tEPSS 3.3%CVE-2021-28561HIGHAdobe Acrobat Reader memory corruption vulnerability could lead to remote code executionEPSS 3.3%CVE-2021-28602HIGHAdobe After Effects Memory corruption could lead to code execution vulnerabilityEPSS 3.3%CVE-2021-44180HIGHAdobe Dimension PCX File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.2%CVE-2021-44181HIGHAdobe Dimension GIF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.2%CVE-2025-14766HIGHOut of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruptionEPSS 3.2%CVE-2020-26984—A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applicatiEPSS 3.2%CVE-2020-26988—A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applicatiEPSS 3.2%CVE-2019-5133CRITICALAn exploitable out-of-bounds write vulnerability exists in the igcore19d.dll BMP parser of the ImageGear 19.3.0 library. A specially craftedEPSS 3.2%CVE-2020-9907HIGHA memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An apEPSS 3.2%KEVCVE-2022-27788HIGHAdobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.2%CVE-2022-27798HIGHAdobe Acrobat Reader DC zoomType Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.2%CVE-2021-35994HIGHAdobe After Effects JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.2%CVE-2021-21047HIGHAdobe Photoshop Out-Of-Bounds Write Vulnerability Could Lead To Remote Code ExecutionEPSS 3.2%CVE-2020-26982—A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applicatiEPSS 3.2%CVE-2020-26983—A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applicatiEPSS 3.2%CVE-2020-17528—Apache NuttX (incubating) Out of Bound Write from invalid TCP Urgent lengthEPSS 3.2%CVE-2025-9132HIGHOut of bounds write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a crEPSS 3.2%