Falhas do tipo CWE-787

5.145 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2024-24188CRITICALJsish v3.5.0 was discovered to contain a heap-buffer-overflow in ./src/jsiUtils.c.EPSS 0.8%CVE-2022-1042HIGHOut-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioningEPSS 0.8%CVE-2024-28123HIGHWasmi Out-of-bounds Write for host to Wasm calls with more than 128 ParametersEPSS 0.8%CVE-2022-36508HIGHH3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function SetAPInfoById.EPSS 0.8%CVE-2022-36504HIGHH3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function Edit_BasicSSID.EPSS 0.8%CVE-2022-43259HIGHTenda AC15 V15.03.05.18 was discovered to contain a stack overflow via the timeZone parameter in the form_fast_setting_wifi_set function.EPSS 0.8%CVE-2017-20225CRITICALTiEmu 2.08 Stack-Based Buffer Overflow VulnerabilityEPSS 0.8%CVE-2026-16840CRITICALVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.8%CVE-2026-17218CRITICALIBM i is Affected By Remote Code Execution Vulnerability in Line Printer Daemon []EPSS 0.8%CVE-2023-29085MEDIUMAn issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos EPSS 0.8%CVE-2022-21740HIGHHeap overflow in TensorflowEPSS 0.8%CVE-2023-29087MEDIUMAn issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos EPSS 0.8%CVE-2020-25647—A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checkingEPSS 0.8%CVE-2022-41741HIGHNGINX ngx_http_mp4_module vulnerability CVE-2022-41741EPSS 0.8%CVE-2023-29086MEDIUMAn issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos EPSS 0.8%CVE-2023-27803MEDIUMH3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm. This vulnerEPSS 0.8%CVE-2024-57575CRITICALTenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.EPSS 0.8%CVE-2025-1268CRITICALOut-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic PlusEPSS 0.8%CVE-2024-32672MEDIUMA Segmentation Fault issue discovered in Samsung Open Source Escargot JavaScript engine allows remote attackers to cause a denial of serEPSS 0.8%CVE-2022-35040MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b5567.EPSS 0.8%