Falhas do tipo CWE-787

5.847 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2026-96020HIGHWindows Domain Name Service Remote Code Execution VulnerabilityEPSS 0.7%CVE-2022-0566HIGHIt may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when procEPSS 0.7%CVE-2026-43501CRITICALipv6: rpl: reserve mac_len headroom when recompressed SRH growsEPSS 0.7%CVE-2022-43035MEDIUMAn issue was discovered in Bento4 v1.6.0-639. There is a heap-buffer-overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to aEPSS 0.7%CVE-2023-34615HIGHAn issue was discovered JSONUtil thru 5.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object thatEPSS 0.7%CVE-2026-16095HIGHShibby Tomato rc setup_conntrack out-of-bounds writeEPSS 0.7%CVE-2026-15545HIGHShibby Tomato apcupsd tomatodata.cgi main out-of-bounds writeEPSS 0.7%CVE-2023-29995HIGHIn NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.cEPSS 0.7%CVE-2023-34617HIGHAn issue was discovered genson thru 1.6 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uEPSS 0.7%CVE-2023-34616HIGHAn issue was discovered pbjson thru 0.4.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object thatEPSS 0.7%CVE-2023-31922HIGHQuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js_proxy_isArray at quickjs.c.EPSS 0.7%CVE-2022-43034MEDIUMAn issue was discovered in Bento4 v1.6.0-639. There is a heap buffer overflow vulnerability in the AP4_BitReader::SkipBits(unsigned int) funEPSS 0.7%CVE-2023-29994HIGHIn NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c.EPSS 0.7%CVE-2022-2044HIGHMOXA NPort 5110 Out-of-bounds WriteEPSS 0.7%CVE-2026-4699HIGHIncorrect boundary conditions in the Layout: Text and Fonts componentEPSS 0.7%CVE-2026-4697HIGHIncorrect boundary conditions in the Audio/Video: Web Codecs componentEPSS 0.7%CVE-2026-4685HIGHIncorrect boundary conditions in the Graphics: Canvas2D componentEPSS 0.7%CVE-2023-51968CRITICALTenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function getIptvInfo.EPSS 0.7%CVE-2023-51967CRITICALTenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function getIptvInfo.EPSS 0.7%CVE-2023-51969CRITICALTenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function getIptvInfo.EPSS 0.7%