目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-786 在缓冲区起始位置之前访问内存 类漏洞列表 3

CWE-786 在缓冲区起始位置之前访问内存 类弱点 3 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-786 属于内存访问越界漏洞，指程序通过指针或索引访问缓冲区起始地址之前的非法内存区域。攻击者常利用此缺陷读取敏感数据或破坏内存结构，进而引发程序崩溃或执行任意代码。开发者应避免使用负索引或错误的指针算术，确保所有内存访问均在缓冲区合法边界内，并引入边界检查机制以防范此类错误。

MITRE CWE 官方描述
CWE：CWE-786 访问缓冲区起始位置之前的内存位置 英文：产品使用引用缓冲区起始位置之前内存位置的索引或指针来读取或写入缓冲区。 这通常发生在指针或其索引被递减到缓冲区之前的位置时，指针算术运算导致位置位于有效内存位置的起始位置之前，或者使用了负索引时。
常见影响 (3)
ConfidentialityRead Memory
For an out-of-bounds read, the attacker may have access to sensitive information. If the sensitive information contains system details, such as the current buffer's position in memory, this knowledge can be used to craft further attacks, possibly with more severe consequences.
Integrity, AvailabilityModify Memory, DoS: Crash, Exit, or Restart
Out of bounds memory access will very likely result in the corruption of relevant memory, and perhaps instructions, possibly leading to a crash.
IntegrityModify Memory, Execute Unauthorized Code or Commands
If the corrupted memory can be effectively controlled, it may be possible to execute arbitrary code. If the corrupted memory is data rather than instructions, the system will continue to function with improper changes, possibly in violation of an implicit or explicit policy.
代码示例 (2)
In the following C/C++ example, a utility function is used to trim trailing whitespace from a character string. The function copies the input string to a local character string and uses a while statement to remove the trailing whitespace by moving backward through the string and overwriting whitespace with a NUL character.
char* trimTrailingWhitespace(char *strMessage, int length) { char *retMessage; char *message = malloc(sizeof(char)*(length+1)); // copy input string to a temporary string char message[length+1]; int index; for (index = 0; index < length; index++) { message[index] = strMessage[index]; } message[index] = '\0'; // trim trailing whitespace int len = index-1; while (isspace(message[len])) { message[len] = '\0'; len--; } // return string without trailing whitespace retMessage = message; return retMessage; }
Bad · C
The following example asks a user for an offset into an array to select an item.
int main (int argc, char **argv) { char *items[] = {"boat", "car", "truck", "train"}; int index = GetUntrustedOffset(); printf("You selected %s\n", items[index-1]); }
Bad · C
CVE ID标题CVSS风险等级Published
CVE-2026-20058 Cisco IOS XE和Cisco Secure Firewall Threat Defense 安全漏洞 — Cisco Secure Firewall Threat Defense (FTD) Software 5.8 Medium2026-03-04
CVE-2022-0522 Radareorg Radare2 缓冲区错误漏洞 — radareorg/radare2 7.1 -2022-02-08
CVE-2022-0351 Vim 缓冲区错误漏洞 — vim/vim 7.8 -2022-01-25

CWE-786（在缓冲区起始位置之前访问内存） 是常见的弱点类别，本平台收录该类弱点关联的 3 条 CVE 漏洞。