Falhas do tipo CWE-787
5.127 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.
Exemplo
Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.
Como mitigar
Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).
CVE-2017-8540HIGHThe Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SPEPSS 71.9%KEVCVE-2010-4344CRITICALHeap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code EPSS 71.7%KEVCVE-2020-13580HIGHAn exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlEPSS 70.7%CVE-2013-3163HIGHMicrosoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) EPSS 70.7%KEVCVE-2022-2294HIGHHeap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption viaEPSS 70.5%KEVCVE-2021-21220HIGHInsufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heEPSS 70.4%KEVCVE-2020-0938HIGHA remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a speciallyEPSS 69.2%KEVCVE-2022-0435—A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content whEPSS 68.0%CVE-2016-4657HIGHWebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crEPSS 66.8%KEVCVE-2020-1020HIGHA remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a speciallyEPSS 65.0%KEVCVE-2021-30632HIGHOut of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 63.2%KEVCVE-2023-45878—GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authenticatiEPSS 63.1%CVE-2009-0563HIGHStack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open EPSS 62.8%KEVCVE-2018-8373HIGHA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripEPSS 61.9%KEVCVE-2021-33742HIGHWindows MSHTML Platform Remote Code Execution VulnerabilityEPSS 59.4%KEVCVE-2022-21882HIGHWin32k Elevation of Privilege VulnerabilityEPSS 59.2%KEVCVE-2019-5825MEDIUMOut of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption viEPSS 55.9%KEVCVE-2020-1054HIGHWin32k Elevation of Privilege VulnerabilityEPSS 54.2%KEVCVE-2015-2419HIGHJScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory coEPSS 53.1%KEVCVE-2015-1642HIGHMicrosoft Office 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft OEPSS 53.1%KEV