Falhas do tipo CWE-788

147 resultados

Acesso de memória além do limite do buffer

Ocorre quando o código tenta ler ou escrever em um endereço de memória que está fora dos limites válidos de um buffer alocado. O programa não valida corretamente o índice ou offset antes de acessar a memória, permitindo leitura de dados sensíveis ou corrupção de estruturas adjacentes. Em ataques, isso pode vazar informações ou causar crash.

Exemplo

Um parser de arquivo aloca 256 bytes para armazenar um campo e, sem validar o tamanho lido do arquivo, copia 500 bytes para esse buffer. O acesso continua além da memória alocada, sobrescrevendo dados do processo ou vazando informações de outra variável próxima na stack.

Como mitigar

Sempre validar tamanhos e índices antes de acessar buffers — use funções seguras (strncpy em vez de strcpy, bounds checking explícito). Em linguagens com gerenciamento automático de memória, o risco reduz, mas em C/C++ exige disciplina: verificar limites, usar ferramentas estáticas (Clang Static Analyzer, Coverity) e testes com fuzzing.

CVE-2020-9731HIGHOut-of-bounds memory access could lead to code executionEPSS 11.3%CVE-2021-21105HIGHAdobe Illustrator memory corruption vulnerability could lead to remote code executionEPSS 5.9%CVE-2021-21104HIGHAdobe Illustrator memory corruption vulnerability could lead to remote code executionEPSS 4.9%CVE-2021-21082HIGHAdobe Photoshop Memory CorruptionEPSS 4.5%CVE-2019-8280—UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially result code execution.EPSS 4.2%CVE-2021-21093HIGHAdobe Bridge SGI File Parsing Memory Corruption vulnerability could lead to arbitrary code executionEPSS 3.9%CVE-2021-21092HIGHAdobe Bridge DCM File Parsing Memory Corruption could lead to arbitrary code executionEPSS 3.9%CVE-2021-45067MEDIUMAdobe Acrobat Reader Memory Corruption could lead to Information DisclosureEPSS 3.9%CVE-2020-27738MEDIUMA vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions <EPSS 3.7%CVE-2021-21103MEDIUMAdobe Illustrator memory corruption vulnerability could lead to information disclosureEPSS 3.3%CVE-2021-36052HIGHXMPToolkit SDK ImportTIFF_CheckStandardMapping Memory CorruptionEPSS 3.2%CVE-2019-8265—UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETPIXELS macro in VNC client codeEPSS 3.1%CVE-2019-8264—UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside Ultra2 decoder, which can potentially result in code execEPSS 3.1%CVE-2020-9727HIGHOut-of-bounds memory access could lead to code executionEPSS 3.1%CVE-2021-36070HIGHAdobe Media Encoder Improper Memory Access When Parsing SVG Files Could Lead To Remote Code ExecutionEPSS 3.0%CVE-2021-36009HIGHAdobe Illustrator PDF File Parsing Memory Corruption Remote Code Execution VulnerabilityEPSS 3.0%CVE-2021-44179HIGHAdobe Dimension GIF File Parsing Memory Corruption Remote Code Execution VulnerabilityEPSS 3.0%CVE-2021-35997HIGHAdobe Premiere Pro Memory Corruption Remote Code Execution VulnerabilityEPSS 2.9%CVE-2019-8266—UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnection::Copybuffer functEPSS 2.8%CVE-2020-24413HIGHAdobe Illustrator Memory Corruption VulnerabilityEPSS 2.8%