Falhas do tipo CWE-787

5.846 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2022-45689HIGHhutool-json v5.8.10 was discovered to contain an out of memory error.EPSS 0.8%CVE-2022-2505HIGHMozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs showed evidence of meEPSS 0.8%CVE-2024-28123HIGHWasmi Out-of-bounds Write for host to Wasm calls with more than 128 ParametersEPSS 0.8%CVE-2022-36504HIGHH3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function Edit_BasicSSID.EPSS 0.8%CVE-2022-36508HIGHH3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function SetAPInfoById.EPSS 0.8%CVE-2025-47868CRITICALApache NuttX RTOS: tools/bdf-converter.: tools/bdf-converter: Fix loop termination condition.EPSS 0.8%CVE-2025-62550HIGHAzure Monitor Agent Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-52963LOWA out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4EPSS 0.8%CVE-2026-17218CRITICALIBM i is Affected By Remote Code Execution Vulnerability in Line Printer Daemon []EPSS 0.8%CVE-2026-16840CRITICALVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.8%CVE-2023-27803MEDIUMH3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm. This vulnerEPSS 0.8%CVE-2020-25647—A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checkingEPSS 0.8%CVE-2022-21740HIGHHeap overflow in TensorflowEPSS 0.8%CVE-2023-29086MEDIUMAn issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos EPSS 0.8%CVE-2023-29087MEDIUMAn issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos EPSS 0.8%CVE-2023-29085MEDIUMAn issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos EPSS 0.8%CVE-2026-100134HIGHAcrobat for Edge | Out-of-bounds Write (CWE-787)EPSS 0.8%CVE-2025-0690MEDIUMGrub2: read: integer overflow may lead to out-of-bounds writeEPSS 0.8%CVE-2026-10027HIGHIBM MQ queue manager is vulnerable to unauthenticated remote code executionEPSS 0.8%CVE-2024-57580CRITICALTenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.EPSS 0.8%