Falhas do tipo CWE-787

5.142 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2026-27853MEDIUMOut-of-bounds write when rewriting large DNS packetsEPSS 1.5%CVE-2023-40567MEDIUMOut-Of-Bounds Write in FreeRDPEPSS 1.5%CVE-2018-3860HIGHAn exploitable out-of-bounds write exists in the TIFF parsing functionality of Canvas Draw version 4.0.0. A specially crafted TIFF image proEPSS 1.5%CVE-2023-27973CRITICALCertain HP LaserJet Pro print products are potentially vulnerable to Heap Overflow and/or Remote Code Execution.EPSS 1.5%CVE-2018-3871HIGHAn exploitable out-of-bounds write exists in the PCX parsing functionality of Canvas Draw version 4.0.0. A specially crafted PCX image proceEPSS 1.5%CVE-2020-1891—A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhEPSS 1.5%CVE-2020-27337HIGHAn issue was discovered in Treck IPv6 before 6.0.1.68. Improper Input Validation in the IPv6 component allows an unauthenticated remote attaEPSS 1.5%CVE-2024-23225HIGHA memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 1EPSS 1.5%KEVCVE-2023-33975CRITICALRIOT-OS vulnerable to Out of Bounds Write in _rbuf_addEPSS 1.5%CVE-2020-28385—A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP4). AffectedEPSS 1.5%CVE-2023-0782HIGHTenda AC23 httpd formGetSysToolDDNS out-of-bounds writeEPSS 1.5%CVE-2022-26700HIGHA memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 1EPSS 1.5%CVE-2022-1015—A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cauEPSS 1.5%CVE-2023-2934HIGHOut of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruptionEPSS 1.5%CVE-2023-32324HIGHOpenPrinting CUPS vulnerable to heap buffer overflowEPSS 1.5%CVE-2021-42704HIGHInkscape Out-of-bounds WriteEPSS 1.5%CVE-2023-6230CRITICALBuffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser EPSS 1.5%CVE-2023-6232CRITICALBuffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser EPSS 1.5%CVE-2018-3870HIGHAn exploitable out-of-bounds write exists in the PCX parsing functionality of Canvas Draw version 4.0.0. A specially crafted PCX image proceEPSS 1.5%CVE-2022-28664MEDIUMA memory corruption vulnerability exists in the httpd unescape functionality of FreshTomato 2022.1. A specially-crafted HTTP request can leaEPSS 1.5%