Falhas do tipo CWE-787

5.135 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2020-7465—The L2TP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted L2TP control packet with AVP Q.931 CausEPSS 3.0%CVE-2022-23200HIGHAdobe After Effects 3GP File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.0%CVE-2022-27798HIGHAdobe Acrobat Reader DC zoomType Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.0%CVE-2022-27788HIGHAdobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.0%CVE-2020-16213—Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user EPSS 3.0%CVE-2021-21048HIGHAdobe Photoshop Buffer Overflow Vulnerability Could Lead To Remote Code Execution VulnerabilityEPSS 3.0%CVE-2021-28605HIGHAdobe After Effects memory corruption could lead to arbitrary code executionEPSS 3.0%CVE-2021-31452HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interactioEPSS 2.9%CVE-2021-37404—Heap buffer overflow in libhdfs native libraryEPSS 2.9%CVE-2022-24058HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User inteEPSS 2.9%CVE-2018-10880MEDIUMLinux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in eEPSS 2.9%CVE-2017-9938—A vulnerability was discovered in Siemens SIMATIC Logon (All versions before V1.6) that could allow specially crafted packets sent to the SIEPSS 2.9%CVE-2020-17529—Apache NuttX (incubating) Out of Bound Write from invalid fragmentation offset value specified in the IP headerEPSS 2.9%CVE-2025-2761HIGHGIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.9%CVE-2021-21067HIGHAdobe Photoshop CoolType arbitrary stack manipulation in Type 1/Multiple MasterEPSS 2.9%CVE-2021-31472HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interactioEPSS 2.8%CVE-2021-31442HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interactioEPSS 2.8%CVE-2020-9565HIGHAdobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary EPSS 2.8%CVE-2020-9564HIGHAdobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary EPSS 2.8%CVE-2020-9559HIGHAdobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary EPSS 2.8%