Falhas do tipo CWE-787

5.847 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2023-0138HIGHHeap buffer overflow in libphonenumber in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to potentially exploit heap corruptEPSS 0.7%CVE-2023-31567HIGHPodofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptAESV3::PdfEncryptAESV3.EPSS 0.7%CVE-2024-20375HIGHA vulnerability in the SIP call processing function of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications MaEPSS 0.7%CVE-2026-4686HIGHIncorrect boundary conditions in the Graphics: Canvas2D componentEPSS 0.7%CVE-2024-5267HIGHSonos Era 100 SMB2 Message Handling Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-112469HIGHAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and EPSS 0.7%CVE-2024-11691HIGHCertain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in EPSS 0.7%CVE-2021-47354HIGHdrm/sched: Avoid data corruptionsEPSS 0.7%CVE-2023-45678MEDIUMOff-by-one heap buffer write in start_decoder in stb_vorbisEPSS 0.7%CVE-2023-45675MEDIUM0 byte write heap buffer overflow in start_decoder in stb_vorbisEPSS 0.7%CVE-2022-45781HIGHBuffer Overflow vulnerability in Tenda AX1803 v1.0.0.1_2994 and earlier allows attackers to run arbitrary code via /goform/SetOnlineDevName.EPSS 0.7%CVE-2025-5099CRITICALKL-001-2025-004: Mobile Dynamix PrinterShare Mobile Print Out-of-bounds WriteEPSS 0.7%CVE-2026-7831HIGHUltraVNC viewer off-by-one stack overflow in ServerInit desktop name parsingEPSS 0.7%CVE-2023-34611HIGHAn issue was discovered mjson thru 1.4.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that EPSS 0.7%CVE-2026-43790CRITICALThe issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A EPSS 0.7%CVE-2023-25732HIGHWhen encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated pEPSS 0.7%CVE-2020-27005—A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected appliEPSS 0.7%CVE-2026-57189LOWAsterisk: Possible RED T.140 Generation Accumulation OOB WriteEPSS 0.7%CVE-2026-96020HIGHWindows Domain Name Service Remote Code Execution VulnerabilityEPSS 0.7%CVE-2020-15212HIGHOut of bounds access in tensorflow-liteEPSS 0.7%