Falhas do tipo CWE-787

5.844 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2021-28816HIGHStack Buffer Overflow Vulnerabilities in QTS, QuTS hero, and QuTScloudEPSS 0.9%CVE-2023-2072HIGHRockwell Automation PowerMonitor 1000 Cross-Site Scripting VulnerabilityEPSS 0.9%CVE-2022-48078CRITICALpycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component ASTree.cpp:BuildFromCode.EPSS 0.9%CVE-2023-34566CRITICALTenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter time at /goform/saveParentControlInfo.EPSS 0.9%CVE-2022-38477HIGHMozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firefox ESR 102.1. Some oEPSS 0.9%CVE-2022-1229HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.2.034. EPSS 0.9%CVE-2023-49404CRITICALTenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formAdvancedSetListSet.EPSS 0.9%CVE-2026-18832HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.9%CVE-2026-17436HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.9%CVE-2021-25670—A vulnerability has been identified in Tecnomatix RobotExpert (All versions < V16.1). Affected applications lack proper validation of user-sEPSS 0.9%CVE-2023-49424HIGHTenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg.EPSS 0.9%CVE-2025-30446MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VenturEPSS 0.9%CVE-2022-27184HIGHHorner Automation Cscape CsfontEPSS 0.9%CVE-2023-36272HIGHLibreDWG v0.10 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit_utf8_to_TU at bits.c.EPSS 0.9%CVE-2020-8109MEDIUMBitdefender ace.xmd parser out-of-bounds write (VA-8772)EPSS 0.9%CVE-2026-5857CRITICALContiki-NG MQTT Client Out-of-Bounds Write in PUBLISH Topic Parser via Persistent State Between TCP SegmentsEPSS 0.9%CVE-2022-22751HIGHMozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve EPSS 0.9%CVE-2022-3050HIGHHeap buffer overflow in WebUI in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage EPSS 0.9%CVE-2022-26764MEDIUMA memory corruption issue was addressed with improved validation. This issue is fixed in watchOS 8.6, tvOS 15.5, macOS Monterey 12.4, iOS 15EPSS 0.9%CVE-2023-33672HIGHTenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function.EPSS 0.9%