Weakness (CWE)
CWE-787: Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
How to prevent it (7 mitigations)
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer.
Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.
-
Operation, Build and Compilation
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
-
Implementation
Consider adhering to the following rules when allocating and managing an application's memory:
- Double check that the buffer is as large as specified.
- When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string.
- Check buffer boundaries if accessing the buffer in a loop and make sure there is no danger of writing past the allocated space.
- If necessary, truncate all input strings to a reasonable length before passing them to the copy and concatenation functions.
-
Operation, Build and Compilation
Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
-
Operation
Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX [REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment.
For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND [REF-1336].
-
Implementation
Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.
Source: MITRE CWE-787
133 results · Clear filters · Feed
-
High 8.8
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperl…
KEV Nov 3, 2021 -
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Nov 3, 2021 -
High 7.8
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperl…
KEV Nov 3, 2021 -
High 7.8
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient…
KEV Nov 3, 2021 -
High 7.8
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.…
KEV Jun 27, 2022 -
High 7.8
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave…
KEV May 23, 2022 -
High 7.8CVE-2019-7287 Exploited
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An applicati…
KEV May 23, 2022 -
Critical 9.8
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity o…
KEV Nov 3, 2021 -
Medium 6.5
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially explo…
KEV Jun 8, 2022 -
Critical 9.8
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-b…
KEV Mar 3, 2022 -
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Nov 3, 2021 -
Medium 4.3
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and …
KEV Jan 10, 2022 -
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Nov 3, 2021 -
High 8.8
Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Ch…
KEV Jun 8, 2022 -
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Mar 25, 2022 -
High 7.5
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Window…
KEV Feb 15, 2022 -
High 8.8
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow…
KEV Nov 3, 2021 -
High 7.8
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow…
KEV Nov 3, 2021 -
High 7.8
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Serv…
KEV Mar 3, 2022 -
High 8.8
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Interne…
KEV Feb 25, 2022 -
High 8.8
Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service …
KEV May 24, 2022 -
High 8.8
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac…
KEV Jun 8, 2022 -
High 8.8
ChakraCore RCE Vulnerability
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerabili…
KEV Mar 28, 2022 -
High 8.8
WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory…
KEV May 24, 2022 -
High 7.8
The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a deni…
KEV May 24, 2022 -
High 7.5
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other…
KEV Mar 28, 2022 -
High 8.8
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service…
KEV Apr 13, 2022 -
High 7.8
Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted docum…
KEV Mar 3, 2022 -
High 7.8
ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server…
KEV Mar 3, 2022 -
High 8.8
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory c…
KEV May 25, 2022 -
High 8.8
JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial …
KEV Mar 28, 2022 -
High 8.8
Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, a…
KEV Mar 3, 2022 -
High 7.8
Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.45…
KEV Mar 3, 2022 -
High 7.8
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Com…
KEV Nov 3, 2021 -
High 7.8
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbit…
KEV Feb 10, 2022 -
High 7.8
Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Off…
KEV Feb 15, 2022 -
High 8.8
The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Serve…
KEV Oct 6, 2025 -
High 8.8
Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbit…
KEV Mar 3, 2022 -
High 8.8
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service…
KEV Mar 30, 2023 -
High 7.8
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execut…
KEV Mar 3, 2022