Falhas do tipo CWE-787
5.142 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.
Exemplo
Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.
Como mitigar
Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).
CVE-2021-28591HIGHAdobe Illustrator PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 1.9%CVE-2025-29384CRITICALIn Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to EPSS 1.9%CVE-2019-13545—In Horner Automation Cscape 9.90 and prior, improper validation of data may cause the system to write outside the intended buffer area, whicEPSS 1.9%CVE-2021-34920HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 1.9%CVE-2021-34877HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 1.9%CVE-2021-34921HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 1.9%CVE-2021-34932HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 1.9%CVE-2021-34928HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 1.9%CVE-2021-34935HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 1.9%CVE-2021-34929HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 1.9%CVE-2021-34923HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 1.9%CVE-2021-34924HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 1.9%CVE-2021-34926HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 1.9%CVE-2021-43554HIGHFATEK Automation WinProladderEPSS 1.9%CVE-2017-6867—A vulnerability was discovered in Siemens SIMATIC WinCC (V7.3 before Upd 11 and V7.4 before SP1), SIMATIC WinCC Runtime Professional (V13 beEPSS 1.9%CVE-2021-46634HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 1.9%CVE-2022-40876CRITICALIn Tenda ax1803 v1.0.0.1, the http requests handled by the fromAdvSetMacMtuWan functions, wanSpeed, cloneType, mac, can cause a stack overflEPSS 1.9%CVE-2021-27390—A vulnerability has been identified in JT2Go (All versions < V13.1.0.3), Teamcenter Visualization (All versions < V13.1.0.3). The TIFF_loadeEPSS 1.9%CVE-2019-13544—Delta Electronics TPEditor, Versions 1.94 and prior. Multiple out-of-bounds write vulnerabilities may be exploited by processing specially cEPSS 1.9%CVE-2021-26562CRITICALOut-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle EPSS 1.9%