Falhas do tipo CWE-787

5.846 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2022-46583CRITICALTRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the reboot_type parameter in the wizard_ipv6 (sub_41C380) function.EPSS 0.9%CVE-2022-46582CRITICALTRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the login_name parameter in the do_graph_auth (sub_4061E0) functionEPSS 0.9%CVE-2022-47126CRITICALTenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.EPSS 0.9%CVE-2022-47117CRITICALTenda A15 V15.13.07.13 was discovered to contain a stack overflow via the security parameter at /goform/WifiBasicSet.EPSS 0.9%CVE-2022-46592CRITICALTRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the set_sta_enrollee_pin_5g fEPSS 0.9%CVE-2022-47122CRITICALTenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd_5g parameter at /goform/WifiBasicSet.EPSS 0.9%CVE-2022-46591CRITICALTRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the reject_url parameter in the reject (sub_41BD60) function.EPSS 0.9%CVE-2022-46585CRITICALTRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the REMOTE_USER parameter in the get_access (sub_45AC2C) function.EPSS 0.9%CVE-2022-46594CRITICALTRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the update_file_name parameter in the auto_up_fw (sub_420A04) functEPSS 0.9%CVE-2022-47118CRITICALTenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasicSet.EPSS 0.9%CVE-2022-46580CRITICALTRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the user_edit_page parameter in the wifi_captive_portal function.EPSS 0.9%CVE-2022-47125CRITICALTenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn_5g parameter at /goform/WifiBasicSet.EPSS 0.9%CVE-2022-47120CRITICALTenda A15 V15.13.07.13 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.EPSS 0.9%CVE-2022-44931HIGHTenda A18 v15.13.07.09 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.EPSS 0.9%CVE-2023-5717HIGHOut-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) componentEPSS 0.9%CVE-2023-45985HIGHTOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 were discovered to contain a stack overflow in the functioEPSS 0.9%CVE-2023-5474HIGHHeap buffer overflow in PDF in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who convinced a user to engage in specific useEPSS 0.9%CVE-2025-27821HIGHHDFS native client: Out of bounds write in URI parser of native HDFS clientEPSS 0.9%CVE-2021-3500—A flaw was found in djvulibre-3.5.28 and earlier. A Stack overflow in function DJVU::DjVuDocument::get_djvu_file() via crafted djvu file mayEPSS 0.9%CVE-2021-47785HIGHEther_MP3_CD_Burner 1.3.8 - Buffer Overflow (SEH)EPSS 0.9%