Falhas do tipo CWE-787

5.133 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2020-27275—Delta Electronics DOPSoft Version 4.0.8.21 and prior is vulnerable to an out-of-bounds write while processing project files, which may allowEPSS 3.3%CVE-2025-14766HIGHOut of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruptionEPSS 3.2%CVE-2019-5133CRITICALAn exploitable out-of-bounds write vulnerability exists in the igcore19d.dll BMP parser of the ImageGear 19.3.0 library. A specially craftedEPSS 3.2%CVE-2020-17528—Apache NuttX (incubating) Out of Bound Write from invalid TCP Urgent lengthEPSS 3.2%CVE-2021-44180HIGHAdobe Dimension PCX File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.1%CVE-2021-44181HIGHAdobe Dimension GIF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.1%CVE-2023-48692CRITICALAzure RTOS NetX Duo Remote Code Execution VulnerabilityEPSS 3.1%CVE-2023-48691HIGHAzure RTOS NetX Duo Remote Code Execution VulnerabilityEPSS 3.1%CVE-2021-27562MEDIUMIn Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure daEPSS 3.1%KEVCVE-2020-26988—A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applicatiEPSS 3.1%CVE-2020-26984—A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applicatiEPSS 3.1%CVE-2021-28586HIGHAdobe After Effects PDF file parsing out-of-bounds write could lead to remote code execution vulnerabilityEPSS 3.1%CVE-2019-1193MEDIUMMicrosoft Browser Memory Corruption VulnerabilityEPSS 3.1%CVE-2022-34217HIGHAdobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.0%CVE-2022-41125HIGHWindows CNG Key Isolation Service Elevation of Privilege VulnerabilityEPSS 3.0%KEVCVE-2021-21047HIGHAdobe Photoshop Out-Of-Bounds Write Vulnerability Could Lead To Remote Code ExecutionEPSS 3.0%CVE-2020-26983—A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applicatiEPSS 3.0%CVE-2020-26982—A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applicatiEPSS 3.0%CVE-2025-9132HIGHOut of bounds write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a crEPSS 3.0%CVE-2022-42920—Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writingEPSS 3.0%