Falhas do tipo CWE-787

5.137 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2017-7467HIGHA buffer overflow flaw was found in the way minicom before version 2.7.1 handled VT100 escape sequences. A malicious terminal device could pEPSS 2.7%CVE-2020-0878MEDIUMMicrosoft Browser Memory Corruption VulnerabilityEPSS 2.7%KEVCVE-2022-28819HIGHAdobe Character Animator SVG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.7%CVE-2020-6089HIGHAn exploitable code execution vulnerability exists in the ANI file format parser of Leadtools 20. A specially crafted ANI file can cause a bEPSS 2.7%CVE-2018-18986—LCDS Laquis SCADA prior to version 4.1.0.4150 allows the opening of a specially crafted report format file that may cause an out of bounds rEPSS 2.7%CVE-2021-42270HIGHAdobe Animate BMP File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.7%CVE-2021-42271HIGHAdobe Animate BMP File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.7%CVE-2021-42524HIGHAdobe Animate BMP File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.7%CVE-2021-42272HIGHAdobe Animate GIF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.7%CVE-2020-36328—A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalEPSS 2.7%CVE-2020-9568HIGHAdobe Bridge versions 10.0.1 and earlier version have a memory corruption vulnerability. Successful exploitation could lead to arbitrary codEPSS 2.7%CVE-2024-13167HIGHAn out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote EPSS 2.6%CVE-2024-13165HIGHAn out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote EPSS 2.6%CVE-2024-13168HIGHAn out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote EPSS 2.6%CVE-2018-10489—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.6%CVE-2018-10483—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.6%CVE-2018-10473—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.6%CVE-2018-10474—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.6%CVE-2018-9982—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.6%CVE-2018-10491—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.6%