Falhas do tipo CWE-787
5.846 resultadosEscrita fora dos limites de memória
Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.
Exemplo
Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.
Como mitigar
Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).
CVE-2024-32672MEDIUMA Segmentation Fault issue discovered in
Samsung Open Source Escargot JavaScript engine
allows remote attackers to cause a denial of serEPSS 0.8%CVE-2026-72098CRITICALdm-verity: fix buffer overflow in FEC calculationEPSS 0.8%CVE-2023-20520CRITICALImproper access control settings in ASP
Bootloader may allow an attacker to corrupt the return address causing a
stack-based buffer overrun EPSS 0.8%CVE-2026-70197HIGH.NET and Visual Studio Remote Code Execution VulnerabilityEPSS 0.8%CVE-2023-27804MEDIUMH3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm. This vulnerabilitEPSS 0.8%CVE-2023-29914MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm.EPSS 0.8%CVE-2023-29916MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm.EPSS 0.8%CVE-2023-29906MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.EPSS 0.8%CVE-2022-37355HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reEPSS 0.8%CVE-2023-27810MEDIUMH3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm. This vEPSS 0.8%CVE-2023-29917MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via go parameter at /goform/aspForm.EPSS 0.8%CVE-2023-29905MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm.EPSS 0.8%CVE-2022-37356HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reEPSS 0.8%CVE-2023-29913MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspForm.EPSS 0.8%CVE-2023-27802MEDIUMH3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EditvsList parameter at /goform/aspForm. This vulnerabiliEPSS 0.8%CVE-2023-29910MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm.EPSS 0.8%CVE-2023-29907MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.EPSS 0.8%CVE-2023-24613MEDIUMThe user interface of Array Networks AG Series and vxAG through 9.4.0.470 could allow a remote attacker to use the gdb tool to overwrite theEPSS 0.8%CVE-2023-29915MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via CMD parameter at /goform/aspForm.EPSS 0.8%CVE-2023-27807MEDIUMH3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the Delstlist interface at /goform/aspForm. This vulnerabilitEPSS 0.8%