Falhas do tipo CWE-787

5.843 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2023-46540HIGHTOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formNtp.EPSS 1.3%CVE-2023-46536HIGHTP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function chkRegVeriRegister.EPSS 1.3%CVE-2026-119958CRITICALWindows LDAP - Lightweight Directory Access Protocol Remote Code Execution VulnerabilityEPSS 1.3%CVE-2019-6827—A CWE-787: Out-of-bounds Write vulnerability exists in Interactive Graphical SCADA System (IGSS), Version 14 and prior, which could cause a EPSS 1.3%CVE-2023-24344HIGHD-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formWlanGuestSetuEPSS 1.3%CVE-2023-51889CRITICALStack Overflow vulnerability in the validate() function in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via EPSS 1.3%CVE-2026-65414CRITICALAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOSEPSS 1.3%CVE-2024-8932CRITICALOOB access in ldap_escapeEPSS 1.3%CVE-2022-44202CRITICALD-Link DIR878 1.02B04 and 1.02B05 are vulnerable to Buffer Overflow.EPSS 1.3%CVE-2022-3597MEDIUMLibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:682EPSS 1.3%CVE-2022-44806CRITICALD-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow.EPSS 1.3%CVE-2022-3598MEDIUMLibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denialEPSS 1.3%CVE-2021-22755—A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of iEPSS 1.3%CVE-2022-45688HIGHA stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSEPSS 1.3%CVE-2022-3626MEDIUMLibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7EPSS 1.3%CVE-2021-32998HIGHThe FANUC R-30iA and R-30iB series controllers are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbEPSS 1.3%CVE-2022-46393CRITICALAn issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffeEPSS 1.3%CVE-2023-31146HIGHVyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignmentEPSS 1.3%CVE-2023-26489CRITICALGuest-controlled out-of-bounds read/write on x86_64 in wasmtimeEPSS 1.3%CVE-2022-36511CRITICALH3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function EditApAdvanceInfo.EPSS 1.3%