Falhas do tipo CWE-787
5.142 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.
Exemplo
Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.
Como mitigar
Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).
CVE-2023-24798CRITICALD-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_475FB0 function. This vulnerability allows attackers toEPSS 1.1%CVE-2022-40861HIGHTenda AC18 router V15.03.05.19 contains a stack overflow vulnerability in the formSetQosBand->FUN_0007db78 function with the request /goformEPSS 1.1%CVE-2023-24799CRITICALD-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_48AF78 function. This vulnerability allows attackers toEPSS 1.1%CVE-2025-24231CRITICALThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app mEPSS 1.1%CVE-2023-2929HIGHOut of bounds write in Swiftshader in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption EPSS 1.1%CVE-2022-32796HIGHA memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.5. An app may be able to exEPSS 1.1%CVE-2023-47359—Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() anEPSS 1.1%CVE-2019-5094HIGHAn exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition cEPSS 1.1%CVE-2026-3083HIGHGStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-32615CRITICALHDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5Z__nbit_decompress_one_byte in H5Znbit.c, caused by the earlier use oEPSS 1.1%CVE-2022-40784HIGHUnlimited strcpy on user input when setting a locale file leads to stack buffer overflow in mIPC camera firmware 5.3.1.2003161406.EPSS 1.1%CVE-2024-22086CRITICALhandle_request in http.c in cherry through 4b877df has an sscanf stack-based buffer overflow via a long URI, leading to remote code executioEPSS 1.1%CVE-2022-3627MEDIUMLibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:686EPSS 1.1%CVE-2023-24958HIGHIBM TS7700 Management Interface command injectionEPSS 1.1%CVE-2021-21257HIGHOut-of-bounds write in RPL-Classic and RPL-LiteEPSS 1.1%CVE-2022-28181HIGHNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user on theEPSS 1.1%CVE-2025-29909HIGHCryptoLib's Crypto_TC_ApplySecurity() Has a Heap Buffer Overflow VulnerabilityEPSS 1.1%CVE-2024-22852CRITICALD-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the function genacgi_main. This vulnerability allows aEPSS 1.1%CVE-2021-22683—Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to crEPSS 1.1%CVE-2026-65414CRITICALAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOSEPSS 1.1%