Falhas do tipo CWE-787
5.729 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.
Exemplo
Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.
Como mitigar
Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).
CVE-2021-32626HIGHLua scripts can overflow the heap-based Lua stack in RedisEPSS 16.2%CVE-2023-26976HIGHTenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.EPSS 15.9%CVE-2019-7286HIGHA memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 SupplementalEPSS 15.9%KEVCVE-2020-3837HIGHA memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 1EPSS 14.8%KEVCVE-2021-30883HIGHA memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2, macOS Monterey 1EPSS 14.7%KEVCVE-2025-0242MEDIUMMemory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6EPSS 14.7%CVE-2006-2362HIGHBuffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423, as used by GNU strings, allows conEPSS 14.5%CVE-2022-43604CRITICALAn out-of-bounds write vulnerability exists in the GetAttributeList attribute_count_request functionality of EIP Stack Group OpENer developmEPSS 14.4%CVE-2022-43605CRITICALAn out-of-bounds write vulnerability exists in the SetAttributeList attribute_count_request functionality of EIP Stack Group OpENer developmEPSS 14.4%CVE-2022-40855CRITICALTenda W20E router V15.11.0.6 contains a stack overflow in the function formSetPortMapping with post request 'goform/setPortMapping/'. This vEPSS 14.1%CVE-2023-40481HIGH7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 13.8%CVE-2024-2173MEDIUMOut of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to perform out of bounds memory access EPSS 13.7%CVE-2023-51092HIGHTenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade.EPSS 12.9%CVE-2022-22675HIGHAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.EPSS 12.5%KEVCVE-2021-45068HIGHAdobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 12.3%CVE-2023-42115CRITICALExim AUTH Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 12.2%CVE-2022-22587CRITICALA memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.EPSS 11.6%KEVCVE-2022-28236HIGHAdobe Acrobat Reader DC Annotation Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 11.6%CVE-2024-44236MEDIUMAn out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, mEPSS 11.4%CVE-2023-46257CRITICALAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofEPSS 11.3%