Falhas do tipo CWE-788

147 resultados

Acesso de memória além do limite do buffer

Ocorre quando o código tenta ler ou escrever em um endereço de memória que está fora dos limites válidos de um buffer alocado. O programa não valida corretamente o índice ou offset antes de acessar a memória, permitindo leitura de dados sensíveis ou corrupção de estruturas adjacentes. Em ataques, isso pode vazar informações ou causar crash.

Exemplo

Um parser de arquivo aloca 256 bytes para armazenar um campo e, sem validar o tamanho lido do arquivo, copia 500 bytes para esse buffer. O acesso continua além da memória alocada, sobrescrevendo dados do processo ou vazando informações de outra variável próxima na stack.

Como mitigar

Sempre validar tamanhos e índices antes de acessar buffers — use funções seguras (strncpy em vez de strcpy, bounds checking explícito). Em linguagens com gerenciamento automático de memória, o risco reduz, mas em C/C++ exige disciplina: verificar limites, usar ferramentas estáticas (Clang Static Analyzer, Coverity) e testes com fuzzing.

CVE-2020-9731HIGHOut-of-bounds memory access could lead to code executionEPSS 11.3%CVE-2021-21105HIGHAdobe Illustrator memory corruption vulnerability could lead to remote code executionEPSS 8.0%CVE-2021-21104HIGHAdobe Illustrator memory corruption vulnerability could lead to remote code executionEPSS 6.6%CVE-2021-21082HIGHAdobe Photoshop Memory CorruptionEPSS 4.6%CVE-2021-21103MEDIUMAdobe Illustrator memory corruption vulnerability could lead to information disclosureEPSS 4.5%CVE-2019-8280—UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially result code execution.EPSS 4.2%CVE-2021-21093HIGHAdobe Bridge SGI File Parsing Memory Corruption vulnerability could lead to arbitrary code executionEPSS 4.1%CVE-2021-21092HIGHAdobe Bridge DCM File Parsing Memory Corruption could lead to arbitrary code executionEPSS 4.1%CVE-2021-36070HIGHAdobe Media Encoder Improper Memory Access When Parsing SVG Files Could Lead To Remote Code ExecutionEPSS 4.1%CVE-2021-35997HIGHAdobe Premiere Pro Memory Corruption Remote Code Execution VulnerabilityEPSS 3.9%CVE-2021-36059HIGHAdobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionEPSS 3.7%CVE-2021-36049HIGHAdobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionEPSS 3.7%CVE-2021-36068HIGHAdobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionEPSS 3.7%CVE-2021-36067HIGHAdobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionEPSS 3.7%CVE-2021-36069HIGHAdobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionEPSS 3.7%CVE-2021-36076HIGHAdobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionEPSS 3.7%CVE-2021-36078HIGHAdobe Bridge PDF File Parsing Memory Corruption Remote Code Execution VulnerabilityEPSS 3.7%CVE-2021-39817HIGHAdobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionEPSS 3.7%CVE-2021-39816HIGHAdobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionEPSS 3.7%CVE-2020-27738MEDIUMA vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions <EPSS 3.7%