Falhas do tipo CWE-787
5.127 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.
Exemplo
Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.
Como mitigar
Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).
CVE-2021-30883HIGHA memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2, macOS Monterey 1EPSS 14.7%KEVCVE-2006-2362HIGHBuffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423, as used by GNU strings, allows conEPSS 14.5%CVE-2022-43604CRITICALAn out-of-bounds write vulnerability exists in the GetAttributeList attribute_count_request functionality of EIP Stack Group OpENer developmEPSS 14.4%CVE-2022-43605CRITICALAn out-of-bounds write vulnerability exists in the SetAttributeList attribute_count_request functionality of EIP Stack Group OpENer developmEPSS 14.4%CVE-2023-40481HIGH7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 13.9%CVE-2022-40855CRITICALTenda W20E router V15.11.0.6 contains a stack overflow in the function formSetPortMapping with post request 'goform/setPortMapping/'. This vEPSS 13.8%CVE-2024-2173MEDIUMOut of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to perform out of bounds memory access EPSS 13.7%CVE-2025-0242MEDIUMMemory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6EPSS 13.1%CVE-2023-51092HIGHTenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade.EPSS 12.9%CVE-2022-22675HIGHAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.EPSS 12.5%KEVCVE-2021-45068HIGHAdobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 12.3%CVE-2022-22587CRITICALA memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.EPSS 11.6%KEVCVE-2022-28236HIGHAdobe Acrobat Reader DC Annotation Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 11.6%CVE-2023-46257CRITICALAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofEPSS 11.3%CVE-2023-25235HIGHTenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function formOneSsidCfgSet via parameter ssid.EPSS 11.1%CVE-2020-8878HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. User interacEPSS 11.1%CVE-2024-4761HIGHOut of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a EPSS 11.0%KEVCVE-2024-44236MEDIUMAn out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, mEPSS 11.0%CVE-2022-45957HIGHZTE ZXHN-H108NS router with firmware version H108NSV1.0.7u_ZRD_GR2_A68 is vulnerable to remote stack buffer overflow.EPSS 10.6%CVE-2024-42948HIGHTenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function. This vuEPSS 10.6%