Falhas do tipo CWE-787
5.145 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.
Exemplo
Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.
Como mitigar
Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).
CVE-2023-27217CRITICALA stack-based buffer overflow in the ChangeFriendlyName() function of Belkin Smart Outlet V2 F7c063 firmware_2.00.11420.OWRT.PVT_SNSV2 allowEPSS 1.0%CVE-2024-20018CRITICALIn wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege wEPSS 1.0%CVE-2024-54508MEDIUMThe issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS SeEPSS 1.0%CVE-2023-1820HIGHHeap buffer overflow in Browser History in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in EPSS 1.0%CVE-2024-5499HIGHOut of bounds write in Streams API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to execute arbitrary code inside a sanEPSS 1.0%CVE-2026-70296CRITICALWindows Imaging Component Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-69819CRITICALRPC Runtime Library Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-29531CRITICALAn attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crEPSS 1.0%CVE-2022-43106CRITICALTenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the schedStartTime parameter in the setSchedWifi function.EPSS 1.0%CVE-2022-43103CRITICALTenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the list parameter in the formSetQosBand function.EPSS 1.0%CVE-2022-43108CRITICALTenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function.EPSS 1.0%CVE-2022-43107CRITICALTenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function.EPSS 1.0%CVE-2022-43104CRITICALTenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the wpapsk_crypto parameter in the fromSetWirelessRepeat function.EPSS 1.0%CVE-2022-43102CRITICALTenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the timeZone parameter in the fromSetSysTime function.EPSS 1.0%CVE-2022-43105CRITICALTenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function.EPSS 1.0%CVE-2022-43101CRITICALTenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.EPSS 1.0%CVE-2025-26508HIGHCertain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers – Potential Remote Code Execution and Potential Elevation of PrivilegeEPSS 1.0%CVE-2023-28445CRITICALDeno improperly handles resizable ArrayBufferEPSS 1.0%CVE-2021-33002—Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arbitrary code. User intEPSS 1.0%CVE-2023-40163CRITICALAn out-of-bounds write vulnerability exists in the allocate_buffer_for_jpeg_decoding functionality of Accusoft ImageGear 20.1. A specially cEPSS 1.0%