Falhas do tipo CWE-787
5.729 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.
Exemplo
Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.
Como mitigar
Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).
CVE-2023-41727CRITICALAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofEPSS 36.4%CVE-2018-17480HIGHExecution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.35EPSS 35.6%KEVCVE-2025-21042HIGHOut-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.EPSS 35.6%KEVCVE-2015-2387HIGHATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,EPSS 34.9%KEVCVE-2016-5198HIGHV8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect oEPSS 34.2%KEVCVE-2018-13383MEDIUMA heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxEPSS 32.5%KEVCVE-2022-4135CRITICALHeap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to pEPSS 31.9%KEVCVE-2020-0968HIGHA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripEPSS 30.7%KEVCVE-2017-0222HIGHA remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorEPSS 29.6%KEVCVE-2018-8653HIGHA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripEPSS 29.6%KEVCVE-2025-14733CRITICALWatchGuard Firebox iked Out of Bounds Write VulnerabilityEPSS 29.4%KEVCVE-2020-12011—A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code executiEPSS 29.2%CVE-2021-30807HIGHA memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14EPSS 28.8%KEVCVE-2017-0149HIGHMicrosoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vEPSS 28.5%KEVCVE-2022-37969HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 28.5%KEVCVE-2023-52755CRITICALksmbd: fix slab out of bounds write in smb_inherit_dacl()EPSS 28.1%CVE-2025-27363HIGHAn out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parseEPSS 27.8%KEVCVE-2023-4355HIGHOut of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption vEPSS 27.7%CVE-2021-3490HIGHLinux kernel eBPF bitwise ops ALU32 bounds trackingEPSS 27.4%CVE-2026-86950HIGHAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 EPSS 26.2%KEV