CWE-787Out-of-bounds Write

Abstraction: Base · CVEs in our corpus: 14,762

The product writes data past the end, or before the beginning, of the intended buffer.

Last updated: 12 September 2026 07:15 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

Control	Title	Family	Why it addresses this CWE
`SI-16`	Memory Protection	SI	Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.

CVE	Risk	CVSS	EPSS	Published
`CVE-2020-14871` KEV	10.0	10.0	0.7984	2020-10-21
`CVE-2022-20700` KEV	10.0	10.0	0.0566	2022-02-10
`CVE-2022-20701` KEV	10.0	10.0	0.0975	2022-02-10
`CVE-2025-24201` KEV	10.0	10.0	0.0380	2025-03-11
`CVE-2025-43300` KEV	10.0	10.0	0.2199	2025-08-21
`CVE-2010-4344` KEV	9.9	9.8	0.7190	2010-12-14
`CVE-2011-2462` KEV	9.9	9.8	0.8656	2011-12-07
`CVE-2013-3346` KEV	9.9	9.8	0.7858	2013-08-30
`CVE-2015-3043` KEV	9.9	9.8	0.7386	2015-04-14
`CVE-2015-3113` KEV	9.9	9.8	0.9994	2015-06-23
`CVE-2017-14491`	9.9	9.8	0.8492	2017-10-04
`CVE-2018-0171` KEV	9.9	9.8	0.9948	2018-03-28
`CVE-2018-1160`	9.9	9.8	0.8654	2018-12-20
`CVE-2019-1663`	9.9	9.8	0.9571	2019-02-28
`CVE-2019-3568` KEV	9.9	9.8	0.3917	2019-05-14
`CVE-2019-16928` KEV	9.9	9.8	0.4164	2019-09-27
`CVE-2019-5544` KEV	9.9	9.8	0.9726	2019-12-06
`CVE-2021-31755` KEV	9.9	9.8	0.8689	2021-05-07
`CVE-2021-20038` KEV	9.9	9.8	0.9991	2021-12-08
`CVE-2021-44790`	9.9	9.8	0.9684	2021-12-20
`CVE-2022-20705`	9.9	10.0	0.8003	2022-02-10
`CVE-2022-20707`	9.9	10.0	0.7532	2022-02-10
`CVE-2022-22587` KEV	9.9	9.8	0.1164	2022-03-18
`CVE-2022-22274`	9.9	9.8	0.7552	2022-03-25
`CVE-2022-42475` KEV	9.9	9.8	0.9947	2023-01-02