Falhas do tipo CWE-787

5.145 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2024-12547HIGHTungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-5717HIGHOut-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) componentEPSS 0.8%CVE-2024-29218HIGHOut-of-bounds write vulnerability exists in KV STUDIO Ver.11.64 and earlier, KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver.6.EPSS 0.8%CVE-2024-3157HIGHOut of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU prEPSS 0.8%CVE-2022-1238HIGHOut-of-bounds Write in libr/bin/format/ne/ne.c in radareorg/radare2EPSS 0.8%CVE-2021-43814HIGHHeap-based OOB write when parsing dwarf DIE info in RizinEPSS 0.8%CVE-2023-30372CRITICALIn Tenda AC15 V15.03.05.19, The function "xkjs_ver32" contains a stack-based buffer overflow vulnerability.EPSS 0.8%CVE-2023-30373CRITICALIn Tenda AC15 V15.03.05.19, the function "xian_pppoe_user" contains a stack-based buffer overflow vulnerability.EPSS 0.8%CVE-2023-34613HIGHAn issue was discovered sojo thru 1.1.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uEPSS 0.8%CVE-2023-30370CRITICALIn Tenda AC15 V15.03.05.19, the function GetValue contains a stack-based buffer overflow vulnerability.EPSS 0.8%CVE-2023-34614HIGHAn issue was discovered jmarsden/jsonij thru 0.5.2 allows attackers to cause a denial of service or other unspecified impacts via crafted obEPSS 0.8%CVE-2022-23560HIGHRead and Write outside of bounds in TFLiteEPSS 0.8%CVE-2022-23574HIGHOut of bounds read and write in TensorflowEPSS 0.8%CVE-2022-23478CRITICALOut of Bound Write in xrdpEPSS 0.8%CVE-2022-3043HIGHHeap buffer overflow in Screen Capture in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user tEPSS 0.8%CVE-2023-32886HIGHIn Modem IMS SMS UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service withEPSS 0.8%CVE-2026-82680HIGHD-Link DSM-G600 Multipart load_file.cgi out-of-bounds writeEPSS 0.8%CVE-2023-1801—The SMB protocol decoder in tcpdump version 4.99.3 can perform an out-of-bounds write when decoding a crafted network packet.EPSS 0.8%CVE-2021-22791MEDIUMA CWE-787: Out-of-bounds Write vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating thEPSS 0.8%CVE-2023-27239CRITICALTenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the shareSpeed parameter at /goform/WifiGuestSet.EPSS 0.8%