Falhas do tipo CWE-787

5.846 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2022-35058MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b05ce.EPSS 0.9%CVE-2022-35053MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x61731f.EPSS 0.9%CVE-2022-35049MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b03b5.EPSS 0.9%CVE-2022-35052MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b84b1.EPSS 0.9%CVE-2026-88165HIGHWindows Active Directory Domain Services Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-7829HIGHUltraVNC repeater authenticated out-of-bounds write in rule parser via oversized tokenEPSS 0.9%CVE-2022-1041HIGHOut-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioningEPSS 0.9%CVE-2022-27653—A vulnerability has been identified in Simcenter Femap (All versions < V2022.2). The affected application contains an out of bounds write paEPSS 0.9%CVE-2022-2043HIGHMOXA NPort 5110 Out-of-bounds WriteEPSS 0.9%CVE-2024-12547HIGHTungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.9%CVE-2022-3043HIGHHeap buffer overflow in Screen Capture in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user tEPSS 0.8%CVE-2024-29218HIGHOut-of-bounds write vulnerability exists in KV STUDIO Ver.11.64 and earlier, KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver.6.EPSS 0.8%CVE-2024-3157HIGHOut of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU prEPSS 0.8%CVE-2023-30372CRITICALIn Tenda AC15 V15.03.05.19, The function "xkjs_ver32" contains a stack-based buffer overflow vulnerability.EPSS 0.8%CVE-2023-30373CRITICALIn Tenda AC15 V15.03.05.19, the function "xian_pppoe_user" contains a stack-based buffer overflow vulnerability.EPSS 0.8%CVE-2023-34613HIGHAn issue was discovered sojo thru 1.1.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uEPSS 0.8%CVE-2023-30370CRITICALIn Tenda AC15 V15.03.05.19, the function GetValue contains a stack-based buffer overflow vulnerability.EPSS 0.8%CVE-2023-34614HIGHAn issue was discovered jmarsden/jsonij thru 0.5.2 allows attackers to cause a denial of service or other unspecified impacts via crafted obEPSS 0.8%CVE-2022-1238HIGHOut-of-bounds Write in libr/bin/format/ne/ne.c in radareorg/radare2EPSS 0.8%CVE-2022-23560HIGHRead and Write outside of bounds in TFLiteEPSS 0.8%