CWE-787: Out-of-bounds Write
Sources read 2026-10-29. MITRE's own page · All weakness notes · Added to CISA's list in the last seven days
What it is
From MITRE's CWE catalogue
The product writes data past the end, or before the beginning, of the intended buffer.
MITRE classes it as a base-level weakness and rates the likelihood of exploit as high.
What it lets an attacker do
From MITRE's CWE catalogue
- Modify Memory, Execute Unauthorized Code or Commands (affects: integrity)
- DoS: Crash, Exit, or Restart (affects: availability)
- Unexpected State (affects: other)
On CISA's exploited list
From CISA's exploited list
6 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-787, against 2 of 69 in the 90 days before. Over the whole catalogue 106 entries name it. The counts are small, so read them as a rough order, not a rate.
CISA's list is not every flaw that is exploited: it holds the ones CISA has evidence of, listed on the day it added them.
- CVE-2026-111497, Google Brotli, added 2026-10-27
- CVE-2026-86950, Apple Multiple Products, added 2026-09-29
- CVE-2026-53266, Linux Kernel, added 2026-09-18
- CVE-2025-25249, Fortinet Multiple Products, added 2026-09-09
- CVE-2026-87491, Google Chromium V8, added 2026-09-09
How MITRE says to find it
From MITRE's CWE catalogue
- Automated Static Analysis
- Automated Dynamic Analysis
What MITRE suggests
From MITRE's CWE catalogue
These are MITRE's suggestions, quoted as it gives them. They are not a complete fix and not a substitute for reading the vendor's advisory for the product you run.
- Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56].
- Operation: Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index …
- Implementation: Consider adhering to the following rules when allocating and managing an application's memory:
Our notes that name it
From our own notes
Start with one piece of work.
Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.
Talk to us