Falhas do tipo CWE-788

147 resultados

Acesso de memória além do limite do buffer

Ocorre quando o código tenta ler ou escrever em um endereço de memória que está fora dos limites válidos de um buffer alocado. O programa não valida corretamente o índice ou offset antes de acessar a memória, permitindo leitura de dados sensíveis ou corrupção de estruturas adjacentes. Em ataques, isso pode vazar informações ou causar crash.

Exemplo

Um parser de arquivo aloca 256 bytes para armazenar um campo e, sem validar o tamanho lido do arquivo, copia 500 bytes para esse buffer. O acesso continua além da memória alocada, sobrescrevendo dados do processo ou vazando informações de outra variável próxima na stack.

Como mitigar

Sempre validar tamanhos e índices antes de acessar buffers — use funções seguras (strncpy em vez de strcpy, bounds checking explícito). Em linguagens com gerenciamento automático de memória, o risco reduz, mas em C/C++ exige disciplina: verificar limites, usar ferramentas estáticas (Clang Static Analyzer, Coverity) e testes com fuzzing.

CVE-2021-45067MEDIUMAdobe Acrobat Reader Memory Corruption could lead to Information DisclosureEPSS 3.6%CVE-2021-36015HIGHAdobe Media Encoder Memory Corruption Could Lead To Remote Code ExecutionEPSS 3.5%CVE-2021-35996HIGHAdobe After Effects Memory Corruption Could Lead To Arbitrary Code ExecutionEPSS 3.2%CVE-2021-36052HIGHXMPToolkit SDK ImportTIFF_CheckStandardMapping Memory CorruptionEPSS 3.2%CVE-2019-8265—UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETPIXELS macro in VNC client codeEPSS 3.1%CVE-2019-8264—UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside Ultra2 decoder, which can potentially result in code execEPSS 3.1%CVE-2020-9727HIGHOut-of-bounds memory access could lead to code executionEPSS 3.1%CVE-2021-44179HIGHAdobe Dimension GIF File Parsing Memory Corruption Remote Code Execution VulnerabilityEPSS 3.1%CVE-2021-36017HIGHAdobe After Effects PDF File Parsing Memory Corruption Remote Code Execution VulnerabilityEPSS 3.0%CVE-2021-36009HIGHAdobe Illustrator PDF File Parsing Memory Corruption Remote Code Execution VulnerabilityEPSS 3.0%CVE-2019-8266—UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnection::Copybuffer functEPSS 2.8%CVE-2020-24414HIGHAdobe Illustrator Memory Corruption VulnerabilityEPSS 2.8%CVE-2020-24412HIGHAdobe Illustrator Memory Corruption VulnerabilityEPSS 2.8%CVE-2020-24413HIGHAdobe Illustrator Memory Corruption VulnerabilityEPSS 2.8%CVE-2020-9730HIGHOut-of-bounds memory access could lead to code executionEPSS 2.7%CVE-2020-9729HIGHOut-of-bounds memory access could lead to code executionEPSS 2.7%CVE-2020-9728HIGHOut-of-bounds memory access could lead to code executionEPSS 2.7%CVE-2020-24415HIGHAdobe Illustrator Memory Corruption VulnerabilityEPSS 2.7%CVE-2021-40733HIGHAdobe Animate Memory Corruption Could Lead To Arbitrary Code ExecutionEPSS 2.6%CVE-2021-27384CRITICALA vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 UpdatEPSS 2.6%