Falhas do tipo CWE-787

5.847 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2026-54627CRITICALSAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)EPSS 0.8%CVE-2026-87121CRITICALOut-of-bounds write in lwIP TCP/IP Stack MQTT Client ApplicationEPSS 0.8%CVE-2026-54626CRITICALSAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch)EPSS 0.8%CVE-2024-57581CRITICALTenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function.EPSS 0.8%CVE-2022-44755CRITICALHCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyViewEPSS 0.8%CVE-2024-57582CRITICALTenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the startIP parameter in the formSetPPTPServer function.EPSS 0.8%CVE-2026-17006HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.8%CVE-2023-4585HIGHMemory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2EPSS 0.8%CVE-2024-41311HIGHIn Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with forged offsets can leaEPSS 0.8%CVE-2024-7973HIGHHeap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of bounds memory read viaEPSS 0.8%CVE-2026-58188HIGHApache Traffic Server: Memory-safety and limit-bypass errors across experimental pluginsEPSS 0.8%CVE-2023-35110HIGHAn issue was discovered jjson thru 0.1.7 allows attackers to cause a denial of service or other unspecified impacts via crafted object that EPSS 0.8%CVE-2023-34612HIGHAn issue was discovered ph-json thru 9.5.5 allows attackers to cause a denial of service or other unspecified impacts via crafted object thaEPSS 0.8%CVE-2023-48111HIGHTenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the function saveParentControlInfo . This vulneraEPSS 0.8%CVE-2022-46881HIGHAn optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash. *Note*: TEPSS 0.8%CVE-2023-48110HIGHTenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the urls parameter in the function saveParentControlInfo . This vulnerabEPSS 0.8%CVE-2023-50986HIGHTenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysLogin function.EPSS 0.8%CVE-2026-33636HIGHLIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64EPSS 0.8%CVE-2025-5943HIGHMicroDicom DICOM Viewer Out-of-bounds WriteEPSS 0.8%CVE-2018-10881MEDIUMA flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denEPSS 0.8%