Falhas do tipo CWE-787

5.846 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2020-15208HIGHData corruption in tensorflow-liteEPSS 0.9%CVE-2023-23518HIGHThe issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS EPSS 0.9%CVE-2025-14231CRITICALBuffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on tEPSS 0.9%CVE-2025-14235CRITICALBuffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker onEPSS 0.9%CVE-2022-35030MEDIUMOTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe954.EPSS 0.9%CVE-2022-35023MEDIUMOTFCC commit 617837b was discovered to contain a segmentation violation via /lib/x86_64-linux-gnu/libc.so.6+0xbb384.EPSS 0.9%CVE-2025-14234CRITICALBuffer overflow in CPCA list processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the netwEPSS 0.9%CVE-2023-29416MEDIUMAn issue was discovered in libbzip3.a in bzip3 before 1.3.0. A bz3_decode_block out-of-bounds write can occur with a crafted archive becauseEPSS 0.9%CVE-2025-14232CRITICALBuffer overflow in XML processing of XPS file in Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on thEPSS 0.9%CVE-2025-14236CRITICALBuffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the networEPSS 0.9%CVE-2023-27042HIGHTenda AX3 V16.03.12.11 is vulnerable to Buffer Overflow via /goform/SetFirewallCfg.EPSS 0.9%CVE-2022-45509HIGHTenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the account parameter at /goform/addUserName.EPSS 0.9%CVE-2022-45508HIGHTenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the new_account parameter at /goform/editUserName.EPSS 0.9%CVE-2022-45524HIGHTenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the opttype parameter at /goform/IPSECsave.EPSS 0.9%CVE-2022-45522HIGHTenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeClientFilter.EPSS 0.9%CVE-2022-45520HIGHTenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/qossetting.EPSS 0.9%CVE-2022-45501HIGHTenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the wl_radio parameter at /goform/wifiSSIDset.EPSS 0.9%CVE-2023-29462HIGHRockwell Automation Arena Simulation Software Remote Code Execution VulnerabilityEPSS 0.9%CVE-2022-45518HIGHTenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SetIpBind.EPSS 0.9%CVE-2022-45499HIGHTenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the wl_radio parameter at /goform/WifiMacFilterGet.EPSS 0.9%