Detalle CWE-787

CWE-787

Out-of-bounds Write
Alto
Draft
2009-10-29
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Notificaciones para un CWE
Manténgase informado sobre cualquier cambio en un CWE específico.
Gestionar notificaciones

Nombre: Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Informaciones generales

Modos de introducción

Implementation

Plataformas aplicables

Lenguaje

Class: Memory-Unsafe (Often)
Name: C (Often)
Name: C++ (Often)
Class: Assembly (Undetermined)

Tecnologías

Class: ICS/OT (Often)

Consecuencias comunes

Alcance Impacto Probabilidad
IntegrityModify Memory, Execute Unauthorized Code or Commands

Note: Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
AvailabilityDoS: Crash, Exit, or Restart

Note: Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
OtherUnexpected State

Note: Subsequent write operations can produce undefined or unexpected results.

Ejemplos observados

Referencias Descripción

CVE-2025-27363

Font rendering library does not properly handle assigning a signed short value to an unsigned long (CWE-195), leading to an integer wraparound (CWE-190), causing too small of a buffer (CWE-131), leading to an out-of-bounds write (CWE-787).

CVE-2023-1017

The reference implementation code for a Trusted Platform Module does not implement length checks on data, allowing for an attacker to write 2 bytes past the end of a buffer.

CVE-2021-21220

Chain: insufficient input validation (CWE-20) in browser allows heap corruption (CWE-787), as exploited in the wild per CISA KEV.

CVE-2021-28664

GPU kernel driver allows memory corruption because a user can obtain read/write access to read-only pages, as exploited in the wild per CISA KEV.

CVE-2020-17087

Chain: integer truncation (CWE-197) causes small buffer allocation (CWE-131) leading to out-of-bounds write (CWE-787) in kernel pool, as exploited in the wild per CISA KEV.

CVE-2020-1054

Out-of-bounds write in kernel-mode driver, as exploited in the wild per CISA KEV.

CVE-2020-0041

Escape from browser sandbox using out-of-bounds write due to incorrect bounds check, as exploited in the wild per CISA KEV.

CVE-2020-0968

Memory corruption in web browser scripting engine, as exploited in the wild per CISA KEV.

CVE-2020-0022

chain: mobile phone Bluetooth implementation does not include offset when calculating packet length (CWE-682), leading to out-of-bounds write (CWE-787)

CVE-2019-1010006

Chain: compiler optimization (CWE-733) removes or modifies code used to detect integer overflow (CWE-190), allowing out-of-bounds write (CWE-787).

CVE-2009-1532

malformed inputs cause accesses of uninitialized or previously-deleted objects, leading to memory corruption

CVE-2009-0269

chain: -1 value from a function call was intended to indicate an error, but is used as an array index instead.

CVE-2002-2227

Unchecked length of SSLv2 challenge value leads to buffer underflow.

CVE-2007-4580

Buffer underflow from a small size value with a large buffer (length parameter inconsistency, CWE-130)

CVE-2007-4268

Chain: integer signedness error (CWE-195) passes signed comparison, leading to heap overflow (CWE-122)

CVE-2009-2550

Classic stack-based buffer overflow in media player using a long entry in a playlist

CVE-2009-2403

Heap-based buffer overflow in media player using a long entry in a playlist

Mitigaciones potenciales

Phases : Requirements
Phases : Architecture and Design
Phases : Operation // Build and Compilation
Phases : Implementation
Phases : Operation // Build and Compilation
Phases : Operation
Phases : Implementation
Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.

Métodos de detección

Automated Static Analysis

Efectividad : High

Automated Dynamic Analysis

This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The software's operation may slow down, but it should not become unstable, crash, or generate incorrect results.

Automated Dynamic Analysis

Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].
Efectividad : Moderate

Notas de mapeo de vulnerabilidades

Justificación : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Comentario : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Referencias

REF-1029

Smashing The Stack For Fun And Profit
Aleph One.
https://phrack.org/issues/49/14.html

REF-7

Writing Secure Code
Michael Howard, David LeBlanc.
https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223

REF-7

Writing Secure Code
Michael Howard, David LeBlanc.
https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223

REF-44

24 Deadly Sins of Software Security
Michael Howard, David LeBlanc, John Viega.

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

REF-90

Buffer UNDERFLOWS: What do you know about it?
https://seclists.org/vuln-dev/2004/Jan/22

REF-56

Using the Strsafe.h Functions
Microsoft.
https://learn.microsoft.com/en-us/windows/win32/menurc/strsafe-ovw?redirectedfrom=MSDN

REF-57

Safe C String Library v1.0.3
Matt Messier, John Viega.
http://www.gnu-darwin.org/www001/ports-1.5a-CURRENT/devel/safestr/work/safestr-1.0.3/doc/safestr.html

REF-58

Address Space Layout Randomization in Windows Vista
Michael Howard.
https://learn.microsoft.com/en-us/archive/blogs/michael_howard/address-space-layout-randomization-in-windows-vista

REF-60

PaX
https://en.wikipedia.org/wiki/Executable_space_protection#PaX

REF-61

Understanding DEP as a mitigation technology part 1
Microsoft.
https://msrc.microsoft.com/blog/2009/06/understanding-dep-as-a-mitigation-technology-part-1/

REF-64

Position Independent Executables (PIE)
Grant Murphy.
https://www.redhat.com/en/blog/position-independent-executables-pie

REF-1332

Prelink and address space randomization
John Richard Moser.
https://lwn.net/Articles/190139/

REF-1333

Jump Over ASLR: Attacking Branch Predictors to Bypass ASLR
Dmitry Evtyushkin, Dmitry Ponomarev, Nael Abu-Ghazaleh.
http://www.cs.ucr.edu/~nael/pubs/micro16.pdf

REF-1334

Stack Frame Canary Validation (D3-SFCV)
D3FEND.
https://d3fend.mitre.org/technique/d3f:StackFrameCanaryValidation/

REF-1335

Segment Address Offset Randomization (D3-SAOR)
D3FEND.
https://d3fend.mitre.org/technique/d3f:SegmentAddressOffsetRandomization/

REF-1336

Process Segment Execution Prevention (D3-PSEP)
D3FEND.
https://d3fend.mitre.org/technique/d3f:ProcessSegmentExecutionPrevention/

REF-1337

Bypassing Browser Memory Protections: Setting back browser security by 10 years
Alexander Sotirov and Mark Dowd.
https://www.blackhat.com/presentations/bh-usa-08/Sotirov_Dowd/bh08-sotirov-dowd.pdf

REF-1477

Secure by Design Alert: Eliminating Buffer Overflow Vulnerabilities
Cybersecurity and Infrastructure Security Agency.
https://www.cisa.gov/resources-tools/resources/secure-design-alert-eliminating-buffer-overflow-vulnerabilities

REF-1518

AddressSanitizer
https://clang.llvm.org/docs/AddressSanitizer.html

Envío

Nombre Organización Fecha Fecha de lanzamiento Version
CWE Content Team MITRE 2009-10-21 +00:00 2009-10-29 +00:00 1.6

Modificaciones

Nombre Organización Fecha Comentario
CWE Content Team MITRE 2010-02-16 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2010-09-27 +00:00 updated Relationships
CWE Content Team MITRE 2011-06-01 +00:00 updated Common_Consequences
CWE Content Team MITRE 2014-06-23 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2015-12-07 +00:00 updated Relationships
CWE Content Team MITRE 2018-03-27 +00:00 updated Description
CWE Content Team MITRE 2019-09-19 +00:00 updated Applicable_Platforms, Demonstrative_Examples, Detection_Factors, Likelihood_of_Exploit, Observed_Examples, Potential_Mitigations, References, Relationships, Time_of_Introduction
CWE Content Team MITRE 2020-02-24 +00:00 updated Observed_Examples, Relationships
CWE Content Team MITRE 2020-06-25 +00:00 updated Observed_Examples
CWE Content Team MITRE 2020-08-20 +00:00 updated Alternate_Terms, Demonstrative_Examples, Observed_Examples, Relationships
CWE Content Team MITRE 2020-12-10 +00:00 updated Relationships
CWE Content Team MITRE 2021-03-15 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2021-07-20 +00:00 updated Demonstrative_Examples, Potential_Mitigations, Relationships
CWE Content Team MITRE 2022-06-28 +00:00 updated Observed_Examples, Relationships
CWE Content Team MITRE 2022-10-13 +00:00 updated Applicable_Platforms
CWE Content Team MITRE 2023-01-31 +00:00 updated Alternate_Terms, Demonstrative_Examples, Description
CWE Content Team MITRE 2023-04-27 +00:00 updated Potential_Mitigations, References, Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes, Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2024-02-29 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2024-07-16 +00:00 updated Alternate_Terms, Common_Consequences, Description, Diagram, Weakness_Ordinalities
CWE Content Team MITRE 2024-11-19 +00:00 updated Observed_Examples, Relationships
CWE Content Team MITRE 2025-04-03 +00:00 updated Observed_Examples, Relationships
CWE Content Team MITRE 2025-09-09 +00:00 updated Affected_Resources, Functional_Areas, References
CWE Content Team MITRE 2025-12-11 +00:00 updated Applicable_Platforms, Detection_Factors, References, Relationships
La información presentada en CVE Find proviene de varias fuentes de referencia cuidadosamente seleccionadas. Los datos CVE son proporcionados por MITRE Corporation y la Base de Datos Nacional de Vulnerabilidades (NVD). El catálogo de Vulnerabilidades Explotadas Conocidas (KEV) proviene de la Agencia de Seguridad de Infraestructura y Ciberseguridad (CISA), mientras que las puntuaciones EPSS provienen de FIRST.org. Además, los datos sobre debilidades de software (CWE) y patrones de ataque comunes (CAPEC) son mantenidos por MITRE Corporation, y la información sobre configuraciones de hardware y software (CPE) es proporcionada por la NVD.