CWE-787 14088 件の CVE MITRE の定義 ↗

CWE-787: Out-of-bounds Write

概要

CWE-787(Out-of-bounds Write)は各種脆弱性データベースや評価で用いられる弱点タイプを説明します。定義・背景・対応する CVE は以下の各セクションを参照してください。

セキュリティへの影響
セキュリティ影響:製品や文脈に依存します。CVE 記録、深刻度、MITRE の説明を参照して優先度を判断してください。

説明

The product writes data past the end, or before the beginning, of the intended buffer.

適用プラットフォーム

種別 名称 クラス 普遍性 OS / CPE
language Memory-Unsafe Often
language C Often
language C++ Often
language Assembly Undetermined
technology ICS/OT Often

このデータベースの関連 CVE

これらの CVE は本データベースでこの弱点に対応付けられており、追跡と検索のために保持されています。

CVE 公開 概要
CVE-2026-54410 2026-06-14 nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header() function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controll…
CVE-2026-6676 2026-06-12 Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed POSIX tar archive may allow Local Execution of Code or Denial-of-Service of the antivirus engine proce…
CVE-2025-14098 2026-06-12 Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malformed MS-DOS executable file may allow Local Execution of Code or Denial-of-Service …
CVE-2026-41157 2026-06-12 A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU user-space driver, leading to memory corruption and possible br…
CVE-2026-34195 2026-06-12 Software installed and run as a non-privileged user may conduct intentional GPU sparse memory API calls to cause out of bounds write in the kernel. The product incorrectly indexes internal state wh…
CVE-2025-7004 2026-06-12 Heap buffer out-of-bounds write vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus process. This issue …
CVE-2026-47965 2026-06-12 Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Ex…
CVE-2026-46690 2026-06-12 unbounded_spsc is an "unbounded" extension of bounded_spsc_queue. In versions 0.2.0 and prior, sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race. At time of pu…
CVE-2026-11933 2026-06-12 A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to r…
CVE-2026-12019 2026-06-11 Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape…
CVE-2026-53702 2026-06-11 A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from …
CVE-2026-53701 2026-06-11 An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partitio…
CVE-2026-53465 2026-06-10 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25, a crafted multi-frame can result in a heap buffer over-write when encoding it …
CVE-2026-53461 2026-06-10 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of b…
CVE-2026-48724 2026-06-10 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-24, when using an image with mask the Floyd-Steinberg dithering method it will cau…
CVE-2026-46559 2026-06-10 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an incorrect check in the JP2 will result in an heap buffer ove…
CVE-2026-46521 2026-06-10 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder an out of bound…
CVE-2026-46520 2026-06-10 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out o…
CVE-2026-11604 2026-06-10 An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kerne…
CVE-2025-10238 2026-06-10 During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System…

コンテンツ投稿

名称
CWE Content Team
組織
MITRE
日付
2009-10-21
バージョン
1.6

コンテンツの変更履歴

日付 名称 バージョン 重要度 コメント
2010-02-16 CWE Content Team 1.8 updated Demonstrative_Examples
2010-09-27 CWE Content Team 1.10 updated Relationships
2011-06-01 CWE Content Team 1.13 updated Common_Consequences
2014-06-23 CWE Content Team 2.7 updated Demonstrative_Examples
2015-12-07 CWE Content Team 2.9 updated Relationships
2018-03-27 CWE Content Team 3.1 updated Description
2019-09-19 CWE Content Team 3.4 updated Applicable_Platforms, Demonstrative_Examples, Detection_Factors, Likelihood_of_Exploit, Observed_Examples, Potential_Mitigations, References, Relationships, Time_of_Introduction
2020-02-24 CWE Content Team 4.0 updated Observed_Examples, Relationships
2020-06-25 CWE Content Team 4.1 updated Observed_Examples
2020-08-20 CWE Content Team 4.2 updated Alternate_Terms, Demonstrative_Examples, Observed_Examples, Relationships
2020-12-10 CWE Content Team 4.3 updated Relationships
2021-03-15 CWE Content Team 4.4 updated Demonstrative_Examples
2021-07-20 CWE Content Team 4.5 updated Demonstrative_Examples, Potential_Mitigations, Relationships
2022-06-28 CWE Content Team 4.8 updated Observed_Examples, Relationships
2022-10-13 CWE Content Team 4.9 updated Applicable_Platforms
2023-01-31 CWE Content Team 4.10 updated Alternate_Terms, Demonstrative_Examples, Description
2023-04-27 CWE Content Team 4.11 updated Potential_Mitigations, References, Relationships, Taxonomy_Mappings
2023-06-29 CWE Content Team 4.12 updated Mapping_Notes, Relationships, Taxonomy_Mappings
2024-02-29 CWE Content Team 4.14 updated Demonstrative_Examples
2024-07-16 CWE Content Team 4.15 updated Alternate_Terms, Common_Consequences, Description, Diagram, Weakness_Ordinalities
2024-11-19 CWE Content Team 4.16 updated Observed_Examples, Relationships
2025-04-03 CWE Content Team 4.17 updated Observed_Examples, Relationships
2025-09-09 CWE Content Team 4.18 updated Affected_Resources, Functional_Areas, References
2025-12-11 CWE Content Team 4.19 updated Applicable_Platforms, Detection_Factors, References, Relationships
2026-04-30 CWE Content Team 4.20 updated Mapping_Notes

貢献

タイプ 名称 日付 コメント
Content "Mapping CWE to 62443" Sub-Working Group 2023-04-25 Suggested mappings to ISA/IEC 62443.
Content Abhi Balakrishnan 2024-02-29 Provided diagram to improve CWE usability
cvelogic Threat Intelligence