Falhas do tipo CWE-787

5.841 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2021-36072HIGHAdobe Bridge SGI File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.1%CVE-2018-1176—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.1%CVE-2021-21048HIGHAdobe Photoshop Buffer Overflow Vulnerability Could Lead To Remote Code Execution VulnerabilityEPSS 3.1%CVE-2023-48691HIGHAzure RTOS NetX Duo Remote Code Execution VulnerabilityEPSS 3.1%CVE-2023-48692CRITICALAzure RTOS NetX Duo Remote Code Execution VulnerabilityEPSS 3.1%CVE-2021-37404—Heap buffer overflow in libhdfs native libraryEPSS 3.1%CVE-2021-28586HIGHAdobe After Effects PDF file parsing out-of-bounds write could lead to remote code execution vulnerabilityEPSS 3.1%CVE-2021-27562MEDIUMIn Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure daEPSS 3.1%KEVCVE-2019-1193MEDIUMMicrosoft Browser Memory Corruption VulnerabilityEPSS 3.1%CVE-2022-34217HIGHAdobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.0%CVE-2022-41125HIGHWindows CNG Key Isolation Service Elevation of Privilege VulnerabilityEPSS 3.0%KEVCVE-2020-7465—The L2TP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted L2TP control packet with AVP Q.931 CausEPSS 3.0%CVE-2021-36066HIGHAdobe Photoshop U3D File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.0%CVE-2022-23200HIGHAdobe After Effects 3GP File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.0%CVE-2021-35993HIGHAdobe After Effects PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.0%CVE-2020-16213—Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user EPSS 3.0%CVE-2021-28605HIGHAdobe After Effects memory corruption could lead to arbitrary code executionEPSS 3.0%CVE-2021-21067HIGHAdobe Photoshop CoolType arbitrary stack manipulation in Type 1/Multiple MasterEPSS 3.0%CVE-2025-5280HIGHOut of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 2.9%CVE-2022-24058HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User inteEPSS 2.9%