Falhas do tipo CWE-787

5.844 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2022-29616—SAP Host Agent, SAP NetWeaver and ABAP Platform allow an attacker to leverage logical errors in memory management to cause a memory corruptiEPSS 1.0%CVE-2024-47537HIGHGHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.cEPSS 1.0%CVE-2023-4353HIGHHeap buffer overflow in ANGLE in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via aEPSS 1.0%CVE-2022-40874HIGHTenda AX1803 v1.0.0.1 was discovered to contain a heap overflow vulnerability in the GetParentControlInfo function, which can cause a denialEPSS 1.0%CVE-2022-40875HIGHTenda AX1803 v1.0.0.1 was discovered to contain a heap overflow in the function GetParentControlInfo.EPSS 1.0%CVE-2026-56388CRITICALApache bRPC: Out-of-Bounds Write in Redis Command ParserEPSS 1.0%CVE-2022-40984CRITICALStack-based buffer overflow in WTViewerE series WTViewerE 761941 from 1.31 to 1.61 and WTViewerEfree from 1.01 to 1.52 allows an attacker toEPSS 1.0%CVE-2022-28314HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. EPSS 1.0%CVE-2022-28300HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation 10.16.02.034 CONNECT.EPSS 1.0%CVE-2022-28301HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. EPSS 1.0%CVE-2022-28316HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. EPSS 1.0%CVE-2022-35043MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c08a6.EPSS 0.9%CVE-2022-35044MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x617087.EPSS 0.9%CVE-2026-3083HIGHGStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.9%CVE-2019-25646CRITICALTabs Mail Carrier 2.5.1 Buffer Overflow via MAIL FROMEPSS 0.9%CVE-2014-125106CRITICALNanopb before 0.3.1 allows size_t overflows in pb_dec_bytes and pb_dec_string.EPSS 0.9%CVE-2026-69705CRITICALWindows iSCSI Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-23086CRITICALBuffer OverFlow Vulnerability in MojoJson v1.2.3 allows an attacker to execute arbitrary code via the SkipString function.EPSS 0.9%CVE-2023-32888HIGHIn Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service witEPSS 0.9%CVE-2023-32887HIGHIn Modem IMS Stack, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no addiEPSS 0.9%