Falhas do tipo CWE-787
5.841 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.
Exemplo
Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.
Como mitigar
Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).
CVE-2017-9938—A vulnerability was discovered in Siemens SIMATIC Logon (All versions before V1.6) that could allow specially crafted packets sent to the SIEPSS 2.9%CVE-2020-17529—Apache NuttX (incubating) Out of Bound Write from invalid fragmentation offset value specified in the IP headerEPSS 2.9%CVE-2020-9560HIGHAdobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary EPSS 2.9%CVE-2020-9565HIGHAdobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary EPSS 2.9%CVE-2020-9564HIGHAdobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary EPSS 2.9%CVE-2020-9554HIGHAdobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary EPSS 2.9%CVE-2020-9569HIGHAdobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary EPSS 2.9%CVE-2020-9559HIGHAdobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary EPSS 2.9%CVE-2022-28819HIGHAdobe Character Animator SVG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.9%CVE-2018-10880MEDIUMLinux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in eEPSS 2.9%CVE-2020-9561HIGHAdobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary EPSS 2.9%CVE-2020-9556HIGHAdobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary EPSS 2.9%CVE-2024-13170HIGHAn out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote EPSS 2.8%CVE-2021-31472HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interactioEPSS 2.8%CVE-2021-31442HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interactioEPSS 2.8%CVE-2022-28277HIGHAdobe Photoshop PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.8%CVE-2021-31465HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598. User interactioEPSS 2.8%CVE-2024-30310HIGHZDI-CAN-23327: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.8%CVE-2024-20728HIGHZDI-CAN-22727: Adobe Acrobat Pro DC Annotation Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.8%CVE-2022-28281HIGHIf a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bouEPSS 2.8%