Falhas do tipo CWE-787

5.856 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2024-0745HIGHThe WebAudio `OscillatorNode` object was susceptible to a stack buffer overflow. This could have led to a potentially exploitable crash. ThiEPSS 0.7%CVE-2026-8053HIGHFlatBSON Duplicate Field Index DriftEPSS 0.7%CVE-2026-12844HIGHList::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise functionEPSS 0.7%CVE-2026-96639CRITICALPillow multi-frame loaders can reuse stale native image storage after mode transitionsEPSS 0.7%CVE-2022-41900HIGHFractionalMaxPool and FractionalAVGPool heap out-of-bounds acess in TensorflowEPSS 0.7%CVE-2026-20616HIGHAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sonoma EPSS 0.7%CVE-2025-37947HIGHksmbd: prevent out-of-bounds stream writes by validating *posEPSS 0.7%CVE-2023-22411HIGHJunos OS: SRX Series: The flow processing daemon (flowd) will crash when Unified Policies are used with IPv6 and certain dynamic applications are rejected by the deviceEPSS 0.7%CVE-2026-26740HIGHBuffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwritingEPSS 0.7%CVE-2024-36761CRITICALnaga v0.14.0 was discovered to contain a stack overflow via the component /wgsl/parse/mod.rs.EPSS 0.7%CVE-2022-23092HIGHMissing bounds check in 9p message handlingEPSS 0.7%CVE-2026-96891CRITICALD-Link DIR-825 rp-l2tp tunnel.c tunnel_set_params out-of-bounds writeEPSS 0.7%CVE-2023-50711MEDIUM`serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory accessEPSS 0.7%CVE-2023-25078CRITICALDoS due to heap overflowEPSS 0.7%CVE-2023-23585CRITICALServer DoS due to heap overflowEPSS 0.7%CVE-2024-23122HIGHMultiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareEPSS 0.7%CVE-2026-15579HIGHAn out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length durEPSS 0.7%CVE-2025-30175HIGHA vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < VEPSS 0.7%CVE-2024-21780HIGHStack-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. Processing a specially crafted command may result in aEPSS 0.7%CVE-2026-3038HIGHLocal DoS and possible privilege escalation via routing socketsEPSS 0.7%