CWE · MITRE source
CWE-787Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Last updated: 16 October 2026 07:24 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
Detect
Catch it (CSF Detect / Respond)
—
Harden
Shrink the surface (DISA STIG)
—
Validate
Prove the fix (OWASP ASVS)
—
NIST 800-53 r5 controls PROPOSED for this weakness (1)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SI-16 | Memory Protection | SI | Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2020-14871 KEV UPD | 10.0 | 10.0 | 0.8016 | 2020-10-21 |
CVE-2022-20700 KEV UPD | 10.0 | 10.0 | 0.0566 | 2022-02-10 |
CVE-2022-20701 KEV UPD | 10.0 | 10.0 | 0.0975 | 2022-02-10 |
CVE-2025-24201 KEV UPD | 10.0 | 10.0 | 0.0385 | 2025-03-11 |
CVE-2025-43300 KEV UPD | 10.0 | 10.0 | 0.3250 | 2025-08-21 |
CVE-2010-4344 KEV UPD | 9.9 | 9.8 | 0.7171 | 2010-12-14 |
CVE-2011-2462 KEV UPD | 9.9 | 9.8 | 0.8888 | 2011-12-07 |
CVE-2013-3346 KEV UPD | 9.9 | 9.8 | 0.7891 | 2013-08-30 |
CVE-2015-3043 KEV UPD | 9.9 | 9.8 | 0.7386 | 2015-04-14 |
CVE-2015-3113 KEV UPD | 9.9 | 9.8 | 0.9981 | 2015-06-23 |
CVE-2017-14491 UPD | 9.9 | 9.8 | 0.8492 | 2017-10-04 |
CVE-2018-0171 KEV UPD | 9.9 | 9.8 | 0.9948 | 2018-03-28 |
CVE-2018-1160 UPD | 9.9 | 9.8 | 0.8654 | 2018-12-20 |
CVE-2019-1663 UPD | 9.9 | 9.8 | 0.9571 | 2019-02-28 |
CVE-2019-3568 KEV UPD | 9.9 | 9.8 | 0.3008 | 2019-05-14 |
CVE-2019-16928 KEV UPD | 9.9 | 9.8 | 0.4164 | 2019-09-27 |
CVE-2019-5544 KEV UPD | 9.9 | 9.8 | 0.9726 | 2019-12-06 |
CVE-2021-31755 KEV UPD | 9.9 | 9.8 | 0.8651 | 2021-05-07 |
CVE-2021-20038 KEV UPD | 9.9 | 9.8 | 0.9991 | 2021-12-08 |
CVE-2021-44790 UPD | 9.9 | 9.8 | 0.9684 | 2021-12-20 |
CVE-2022-20705 UPD | 9.9 | 10.0 | 0.8004 | 2022-02-10 |
CVE-2022-20707 UPD | 9.9 | 10.0 | 0.7532 | 2022-02-10 |
CVE-2022-22587 KEV UPD | 9.9 | 9.8 | 0.1164 | 2022-03-18 |
CVE-2022-22274 UPD | 9.9 | 9.8 | 0.7552 | 2022-03-25 |
CVE-2022-35711 UPD | 9.9 | 9.8 | 0.7393 | 2022-10-14 |