CWE-787: Out-of-bounds Write, page 27
Filter
The product writes data past the end, or before the beginning, of the intended buffer.
What the weakness is: CWE-787 at MITRE
Ask an AI about CWE-787
Show the prompt
Explain CWE-787: Out-of-bounds Write and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/787.html and https://cve.bz/cve/cwe/787?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.8CVE-2026-48306EPSS 0.1%
Substance3D - Sampler versions 6.0.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in…
- 7.8CVE-2026-48305EPSS 0.1%
Substance3D - Sampler versions 6.0.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in…
- 7.8CVE-2026-34710EPSS 0.1%
Substance3D - Sampler versions 6.0.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in…
- 7.8CVE-2026-34709EPSS 0.1%
Substance3D - Sampler versions 6.0.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in…
- 7.8CVE-2026-48293EPSS 0.1%
InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction …
- 7.8CVE-2026-34706EPSS 0.1%
InCopy versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a …
- 7.8CVE-2026-34700EPSS 0.1%
InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction …
- 8.1CVE-2026-7383EPSS 0.8%
Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker co…
- 9.1CVE-2026-49840EPSS 0.3%
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, esl_recv_event() parses Content…
- 7.5CVE-2026-49475EPSS 0.3%
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, a STUN packet whose declared at…
- 7.5CVE-2026-48563EPSS 0.5%
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- 7.5CVE-2026-47654EPSS 0.5%
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- 8.8CVE-2026-47653EPSS 0.6%
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- 7.8CVE-2026-45645EPSS 0.4%
Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
- 8.4CVE-2026-45474EPSS 0.4%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- 8.4CVE-2026-45472EPSS 0.4%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- 8.4CVE-2026-45461EPSS 0.4%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- 7.5CVE-2026-44801EPSS 0.5%
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- 8.8CVE-2026-42985EPSS 1.3%
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- 7.5CVE-2026-42913EPSS 0.5%
Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- 7.8CVE-2026-42910EPSS 0.3%
Out-of-bounds write in Windows Hotpatch Monitoring Service allows an authorized attacker to elevate privileges locally.
- 7.5CVE-2026-42909EPSS 0.4%
Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- 4.9CVE-2026-3088EPSS 0.4%
Unauthenticated users on the local network can cause the router to become unavailable by sending specially crafted requests.
- 9.8CVE-2026-9698EPSS 0.5%
DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can…
- 8.8CVE-2026-5068EPSS 0.5%
A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enables segmentation (via chan_ops.alloc_buf) and the chosen RX pool has a user_data…
- 9.8CVE-2026-5067EPSS 0.6%
A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header. The HTTP/1 header parser copies the header into a fixed-size buffer using a boun…
- 7.5CVE-2026-11690EPSS 0.2%
Out of bounds read and write in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security…
- 8.3CVE-2026-11672EPSS 0.2%
Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity…
- 8.8CVE-2026-11645KEVEPSS 2.4%
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- 7.8CVE-2026-46294EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_s…
- 7.8CVE-2026-46281EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix buffer overflow in vrealloc_node_align() Commit 4c5d3365882d ("mm/vmalloc: allow to set node and align in vrealloc") added the ability to force a new alloca…
- 8.8CVE-2026-48095EPSS 1.1%
7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing att…
- 9.8CVE-2026-10879EPSS 0.5%
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characte…
- 7.8CVE-2026-50264EPSS 0.1%
An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap…
- 8.8CVE-2026-11173EPSS 0.3%
Out of bounds write in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 8.8CVE-2026-11091EPSS 0.2%
Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
- 6.5CVE-2026-11090EPSS 0.3%
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- 9.6CVE-2026-11043EPSS 0.3%
Out of bounds write in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Me…
- 9.6CVE-2026-11037EPSS 0.3%
Out of bounds write in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)
- 6.5CVE-2026-10999EPSS 0.3%
Integer overflow in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chrom…
- 8.8CVE-2026-10941EPSS 0.4%
Out of bounds memory access in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.3CVE-2026-10925EPSS 0.3%
Out of bounds write in Skia in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Hig…
- 8.8CVE-2026-10907EPSS 0.3%
Out of bounds write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.8CVE-2026-10897EPSS 0.3%
Inappropriate implementation in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
- 9.6CVE-2026-10892EPSS 0.3%
Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
- 8.8CVE-2026-10883EPSS 0.6%
Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
- 9.6CVE-2026-10881EPSS 0.6%
Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
- 8.8CVE-2026-5066EPSS 0.3%
A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c). When the TLS session cache is enabled, tls_session_store() and tls_session_restore() memcpy…
- 6.3CVE-2026-5589EPSS 0.3%
An integer underflow in bt_mesh_sol_recv() in the Bluetooth Mesh solicitation handling (subsys/bluetooth/mesh/solicitation.c) leads to an out-of-bounds write. When CONFIG_BT_MESH_OD_PRIV_PROXY_SRV is enabled, the function parses solicitati…
- 6.8CVE-2026-48040EPSS 0.2%
The netty incubator codec.bhttp is a java language binary http parser. The library implements Oblivious HTTP (RFC 9458) using BoringSSL's HPKE C library via JNI. When deriving native memory addresses for cryptographic operations versions p…