CWE-787 · Memory Corruption
Out-of-bounds Write
11,340CVEs
129exploited
2with a public check
559likely (EPSS 10%+)
SortMost likely exploited
11,340 CVEs with CWE-787 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-4863In CISA KEVExploitedHeap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML pa…Google · Chrome · CVSS 8.8 · 2023-09-12 | 8.8 | 100% | 2023-09-12 |
| CVE-2008-2992In CISA KEVExploitedStack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript fu…Adobe · Acrobat and Reader · CVSS 7.8 · 2008-11-04 | 7.8 | 100% | 2008-11-04 |
| CVE-2023-34048In CISA KEVExploitedVMware vCenter Server - Out-of-Bounds WriteVMware · VMware vCenter Server · CVSS 9.8 · 2023-10-25 | 9.8 | 99% | 2023-10-25 |
| CVE-2019-5544In CISA KEVExploitedVMware ESXi SLP - Heap Overflow DoSVMware · ESXi and Horizon DaaS · CVSS 9.8 · 2019-12-06 | 9.8 | 98% | 2019-12-06 |
| CVE-2015-1641In CISA KEVExploitedMicrosoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint…Microsoft · Office · CVSS 7.8 · 2015-04-14 | 7.8 | 97% | 2015-04-14 |
| CVE-2018-0798In CISA KEVExploitedEquation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objec…Microsoft Corporation · Equation Editor · CVSS 8.8 · 2018-01-10 | 8.8 | 95% | 2018-01-10 |
| CVE-2021-4034In CISA KEVExploitedA local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as pr…Red Hat · polkit · CVSS 7.8 · 2022-01-28 | 7.8 | 95% | 2022-01-28 |
| CVE-2016-0189In CISA KEVExploitedThe Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code…Microsoft · Internet Explorer · CVSS 7.5 · 2016-05-11 | 7.5 | 94% | 2016-05-11 |
| CVE-2018-0802In CISA KEVExploitedEquation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way object…Microsoft Corporation · Equation Editor · CVSS 7.8 · 2018-01-10 | 7.8 | 93% | 2018-01-10 |
| CVE-2025-9242In CISA KEVExploitedWatchGuard Firebox iked Out of Bounds Write VulnerabilityWatchGuard · Fireware OS · CVSS 9.3 · 2025-09-17 | 9.3 | 92% | 2025-09-17 |
| CVE-2012-0754In CISA KEVExploitedAdobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Andr…Adobe · Flash Player · CVSS 7.8 · 2012-02-16 | 7.8 | 91% | 2012-02-16 |
| CVE-2021-35211In CISA KEVExploitedSolarWinds Serv-U FTP - Remote Code ExecutionSolarWinds · Serv-U Managed File Transfer Server and Serv-U Secured FTP · CVSS 9 · 2021-07-14 | 9.0 | 91% | 2021-07-14 |
| CVE-2010-3333In CISA KEVExploitedStack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format…Microsoft · Office · CVSS 7.8 · 2010-11-10 | 7.8 | 89% | 2010-11-10 |
| CVE-2011-2462In CISA KEVExploitedUnspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote at…Adobe · Reader and Acrobat · CVSS 8.8 · 2011-12-07 | 8.8 | 89% | 2011-12-07 |
| CVE-2018-8174In CISA KEVExploitedA remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This…Microsoft · Windows 7 · CVSS 7.5 · 2018-05-09 | 7.5 | 88% | 2018-05-09 |
| CVE-2013-0640In CISA KEVExploitedAdobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corrup…Adobe · Reader and Acrobat · CVSS 7.8 · 2013-02-14 | 7.8 | 87% | 2013-02-14 |
| CVE-2021-31755In CISA KEVExploitedTenda Router AC11 - Remote Command InjectionTenda · AC11 Router · CVSS 9.8 · 2021-05-07 | 9.8 | 87% | 2021-05-07 |
| CVE-2024-21762In CISA KEVExploitedA out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0…Fortinet · FortiOS · CVSS 9.6 · 2024-02-09 | 9.6 | 85% | 2024-02-09 |
| CVE-2009-3129In CISA KEVExploitedMicrosoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel V…Microsoft · Excel · CVSS 7.8 · 2009-11-11 | 7.8 | 84% | 2009-11-11 |
| CVE-2012-1889In CISA KEVExploitedMicrosoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (m…Microsoft · XML Core Services · CVSS 8.8 · 2012-06-13 | 8.8 | 84% | 2012-06-13 |
| CVE-2009-3953In CISA KEVExploitedThe U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code v…Adobe · Acrobat and Reader · CVSS 8.8 · 2010-01-13 | 8.8 | 83% | 2010-01-13 |
| CVE-2016-7200In CISA KEVExploitedThe Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site,…Microsoft · Edge · CVSS 8.8 · 2016-11-10 | 8.8 | 83% | 2016-11-10 |
| CVE-2026-111497In CISA KEVExploitedOut-of-Bounds Write in Google Brotli DecoderGoogle · Brotli · CVSS 9.2 · 2026-10-22 | 9.2 | 83% | 2026-10-22 |
| CVE-2010-1297In CISA KEVExploitedAdobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Ma…Adobe · Flash Player · CVSS 7.8 · 2010-06-08 | 7.8 | 83% | 2010-06-08 |
| CVE-2010-2883In CISA KEVExploitedStack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary…Adobe · Acrobat and Reader · CVSS 7.3 · 2010-09-09 | 7.3 | 81% | 2010-09-09 |
| CVE-2020-14871In CISA KEVExploitedVulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable…Oracle Corporation · Solaris Operating System · CVSS 10 · 2020-10-21 | 10.0 | 80% | 2020-10-21 |
| CVE-2013-3346In CISA KEVExploitedAdobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) v…Adobe · Reader and Acrobat · CVSS 8.8 · 2013-08-30 | 8.8 | 79% | 2013-08-30 |
| CVE-2021-22555In CISA KEVExploitedHeap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACELinux · Linux Kernel · CVSS 8.3 · 2021-07-07 | 8.3 | 79% | 2021-07-07 |
| CVE-2021-1732In CISA KEVExploitedWindows Win32k Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1803 · CVSS 7.8 · 2021-02-25 | 7.8 | 78% | 2021-02-25 |
| CVE-2014-1761In CISA KEVExploitedMicrosoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Ser…Microsoft · Word · CVSS 7.8 · 2014-03-24 | 7.8 | 78% | 2014-03-24 |
| CVE-2021-38406In CISA KEVExploitedDelta Electronics DOPSoft 2 Out-of-Bounds WriteDelta Electronics · DOPSoft 2 · CVSS 7.8 · 2021-09-17 | 7.8 | 76% | 2021-09-17 |
| CVE-2015-3043In CISA KEVExploitedAdobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cau…Adobe · Flash Player · CVSS 7.8 · 2015-04-14 | 7.8 | 74% | 2015-04-14 |
| CVE-2013-3918In CISA KEVExploitedThe InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R…Microsoft · Windows · CVSS 8.8 · 2013-11-12 | 8.8 | 74% | 2013-11-12 |
| CVE-2017-8540In CISA KEVExploitedThe Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows…Microsoft Corporation · Malware Protection Engine · CVSS 7.8 · 2017-05-26 | 7.8 | 72% | 2017-05-26 |
| CVE-2010-4344In CISA KEVExploitedHeap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two M…Exim · Exim · CVSS 9.8 · 2010-12-14 | 9.8 | 72% | 2010-12-14 |
| CVE-2022-2294In CISA KEVExploitedHeap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google · Chrome · CVSS 8.8 · 2022-07-28 | 8.8 | 71% | 2022-07-28 |
| CVE-2013-3163In CISA KEVExploitedMicrosoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet E…Microsoft · Internet Explorer · CVSS 8.8 · 2013-07-10 | 8.8 | 71% | 2013-07-10 |
| CVE-2021-21220In CISA KEVExploitedInsufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google · Chrome · CVSS 8.8 · 2021-04-26 | 8.8 | 70% | 2021-04-26 |
| CVE-2020-0938In CISA KEVExploitedA remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type…Microsoft · Windows · CVSS 7.8 · 2020-04-15 | 7.8 | 69% | 2020-04-15 |
| CVE-2016-4657In CISA KEVExploitedWebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.Apple · iOS · CVSS 8.8 · 2016-08-25 | 8.8 | 67% | 2016-08-25 |
| CVE-2020-1020In CISA KEVExploitedA remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type…Microsoft · Windows · CVSS 8.8 · 2020-04-15 | 8.8 | 65% | 2020-04-15 |
| CVE-2021-30632In CISA KEVExploitedOut of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google · Chrome · CVSS 8.8 · 2021-10-08 | 8.8 | 63% | 2021-10-08 |
| CVE-2025-43300In CISA KEVExploitedAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadO…Apple · iOS and iPadOS · CVSS 10 · 2025-08-21 | 10.0 | 63% | 2025-08-21 |
| CVE-2018-8373In CISA KEVExploitedA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerabi…Microsoft · Internet Explorer 9 · CVSS 7.5 · 2018-08-15 | 7.5 | 62% | 2018-08-15 |
| CVE-2009-0563In CISA KEVExploitedStack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Micr…Microsoft · Office · CVSS 7.8 · 2009-06-10 | 7.8 | 60% | 2009-06-10 |
| CVE-2021-33742In CISA KEVExploitedWindows MSHTML Platform Remote Code Execution VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7.5 · 2021-06-08 | 7.5 | 59% | 2021-06-08 |
| CVE-2022-21882In CISA KEVExploitedWin32k Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7 · 2022-01-11 | 7.0 | 59% | 2022-01-11 |
| CVE-2019-5825In CISA KEVExploitedOut of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google · Chrome · CVSS 6.5 · 2019-11-25 | 6.5 | 56% | 2019-11-25 |
| CVE-2020-1054In CISA KEVExploitedWin32k Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 7 · 2020-05-21 | 7.0 | 54% | 2020-05-21 |
| CVE-2015-1642In CISA KEVExploitedMicrosoft Office 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."Microsoft · Office · CVSS 7.8 · 2015-08-15 | 7.8 | 53% | 2015-08-15 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.