Falhas do tipo CWE-787
5.127 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.
Exemplo
Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.
Como mitigar
Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).
CVE-2023-28206HIGHAn out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadEPSS 23.0%KEVCVE-2023-32435HIGHA memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 andEPSS 23.0%KEVCVE-2024-29943CRITICALAn attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. This EPSS 22.9%CVE-2023-26497HIGHAn issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos AutoEPSS 22.6%CVE-2024-37079CRITICALvCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access toEPSS 22.4%KEVCVE-2020-27930HIGHA memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9EPSS 22.0%KEVCVE-2025-43300CRITICALAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 aEPSS 22.0%KEVCVE-2024-0517HIGHOut of bounds write in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crEPSS 21.7%CVE-2020-10828CRITICALA stack-based buffer overflow in cvmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieveEPSS 20.9%CVE-2020-10827CRITICALA stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieveEPSS 20.9%CVE-2021-21148HIGHHeap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crEPSS 20.0%KEVCVE-2024-21591CRITICALJunos OS: SRX Series and EX Series: Security Vulnerability in J-web allows a preAuth Remote Code ExecutionEPSS 17.7%CVE-2020-24436HIGHAcrobat Pro DC PDF Export Out-Of-Bounds Write Vulnerability Could Lead to Arbitrary Code ExecutionEPSS 17.0%CVE-2023-25234CRITICALTenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromAddressNat via parameters entrys and mitInterface.EPSS 16.6%CVE-2023-43641HIGHlibcue vulnerable to out-of-bounds array accessEPSS 16.6%CVE-2021-32626HIGHLua scripts can overflow the heap-based Lua stack in RedisEPSS 16.2%CVE-2020-3837HIGHA memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 1EPSS 16.1%KEVCVE-2023-26976HIGHTenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.EPSS 15.9%CVE-2020-0986HIGHAn elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel ElevaEPSS 15.9%KEVCVE-2019-7286HIGHA memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 SupplementalEPSS 15.6%KEV