Cyber Resilience

CWE · MITRE source

CWE-787Out-of-bounds Write

Abstraction: Base · CVEs in our corpus: 14,596

The product writes data past the end, or before the beginning, of the intended buffer.

Last updated: 22 August 2026 00:25 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SI-16 Memory Protection
  • ID.RA-01
  • PR.PS-02
  • PR.PS-06
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (1)AI-assisted

Control Title Family Why it addresses this CWE
SI-16Memory ProtectionSIOut-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2020-14871 KEV 10.010.00.79842020-10-21
CVE-2022-20700 KEV 10.010.00.05662022-02-10
CVE-2022-20701 KEV 10.010.00.09752022-02-10
CVE-2025-24201 KEV 10.010.00.04122025-03-11
CVE-2025-43300 KEV 10.010.00.20392025-08-21
CVE-2010-4344 KEV 9.99.80.71902010-12-14
CVE-2011-2462 KEV 9.99.80.86562011-12-07
CVE-2013-3346 KEV 9.99.80.78582013-08-30
CVE-2015-3043 KEV 9.99.80.74452015-04-14
CVE-2015-3113 KEV 9.99.80.99942015-06-23
CVE-2017-14491 9.99.80.84922017-10-04
CVE-2018-0171 KEV 9.99.80.99492018-03-28
CVE-2018-1160 9.99.80.86542018-12-20
CVE-2019-1663 9.99.80.95712019-02-28
CVE-2019-3568 KEV 9.99.80.39172019-05-14
CVE-2019-16928 KEV 9.99.80.42482019-09-27
CVE-2019-5544 KEV 9.99.80.96822019-12-06
CVE-2021-31755 KEV 9.99.80.85852021-05-07
CVE-2021-20038 KEV 9.99.80.99902021-12-08
CVE-2021-44790 9.99.80.97112021-12-20
CVE-2022-20705 9.910.00.80032022-02-10
CVE-2022-20707 9.910.00.75322022-02-10
CVE-2022-22587 KEV 9.99.80.11642022-03-18
CVE-2022-42475 KEV 9.99.80.99472023-01-02
CVE-2023-27997 KEV 9.99.80.85692023-06-13