CWE-787Base26 in KEV

Out-of-bounds Write

Draft in the CWE catalog · 3,204 CVEs mapped

3,204

CVEs mapped

In KEV

7.8

Median CVSS

What it is

The product writes data past the end, or before the beginning, of the intended buffer.

Recent examples

8.7cvss

CVE-2026-14297

The Continuous Glucose Monitoring Service's Record Access Control Point (RACP) write handler `memcpy`s the entire attacker-supplied ATT write value into a fixed 20-byte BSS buffer.

A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be predetermined - it is entirely dependent on the linker-assigned BSS layout of the specific firmware build, which may vary.

HIGHno explanation yet

OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries

LOWno explanation yet

Out-of-bounds write vulnerability in Samsung Opensource Walrus allows Overflow Buffers

Out-of-bounds write vulnerability in Samsung Opensource Walrus allows Overflow Buffers. This issue affects Walrus: af80e665ea49d9003695a66502f841ed1d8397e7.

HIGHno explanation yet

—

epss

The record

Technical detail

CWE ID: CWE-787
Abstraction: Base
Structure: Simple
Status: Draft

References (18)

https://phrack.org/issues/49/14.html https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223 https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223 https://seclists.org/vuln-dev/2004/Jan/22 https://learn.microsoft.com/en-us/windows/win32/menurc/strsafe-ovw?redirectedfrom=MSDN http://www.gnu-darwin.org/www001/ports-1.5a-CURRENT/devel/safestr/work/safestr-1.0.3/doc/safestr.html https://learn.microsoft.com/en-us/archive/blogs/michael_howard/address-space-layout-randomization-in-windows-vista https://en.wikipedia.org/wiki/Executable_space_protection#PaX https://msrc.microsoft.com/blog/2009/06/understanding-dep-as-a-mitigation-technology-part-1/https://www.redhat.com/en/blog/position-independent-executables-pie https://lwn.net/Articles/190139/http://www.cs.ucr.edu/~nael/pubs/micro16.pdf https://d3fend.mitre.org/technique/d3f:StackFrameCanaryValidation/https://d3fend.mitre.org/technique/d3f:SegmentAddressOffsetRandomization/https://d3fend.mitre.org/technique/d3f:ProcessSegmentExecutionPrevention/https://www.blackhat.com/presentations/bh-usa-08/Sotirov_Dowd/bh08-sotirov-dowd.pdf https://www.cisa.gov/resources-tools/resources/secure-design-alert-eliminating-buffer-overflow-vulnerabilities https://clang.llvm.org/docs/AddressSanitizer.html