Falhas do tipo CWE-787

5.843 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2023-24958HIGHIBM TS7700 Management Interface command injectionEPSS 1.1%CVE-2026-116785CRITICALFreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handlingEPSS 1.1%CVE-2021-21257HIGHOut-of-bounds write in RPL-Classic and RPL-LiteEPSS 1.1%CVE-2023-24098HIGHTrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url EPSS 1.1%CVE-2023-24097HIGHTrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url EPSS 1.1%CVE-2022-26769HIGHA memory corruption issue was addressed with improved input validation. This issue is fixed in Security Update 2022-004 Catalina, macOS MontEPSS 1.1%CVE-2025-29909HIGHCryptoLib's Crypto_TC_ApplySecurity() Has a Heap Buffer Overflow VulnerabilityEPSS 1.1%CVE-2022-45640HIGHTenda Tenda AC6V1.0 V15.03.05.19 is affected by buffer overflow. Causes a denial of service (local).EPSS 1.1%CVE-2019-5188HIGHA code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directorEPSS 1.1%CVE-2022-2598MEDIUMOut-of-bounds Write to API in vim/vimEPSS 1.1%CVE-2024-22852CRITICALD-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the function genacgi_main. This vulnerability allows aEPSS 1.1%CVE-2021-22683—Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to crEPSS 1.1%CVE-2023-1810HIGHHeap buffer overflow in Visuals in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who had compromised the renderer process tEPSS 1.1%CVE-2023-33659HIGHA heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nmq_subinfo_decode(EPSS 1.1%CVE-2022-3725MEDIUMCrash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture fileEPSS 1.1%CVE-2023-27019CRITICALTenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the sub_458FBC function. This vulnerability allows aEPSS 1.1%CVE-2023-27018CRITICALTenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the sub_45EC1C function. This vulnerability allows aEPSS 1.1%CVE-2023-27013CRITICALTenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the get_parentControl_list_Info function. This vulneEPSS 1.1%CVE-2023-27021CRITICALTenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the formSetFirewallCfg function. This vulnerability EPSS 1.1%CVE-2023-27020CRITICALTenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the saveParentControlInfo function. This vulnerabiliEPSS 1.1%