Out-of-bounds Write
CWE-787: Out-of-bounds Write
An out-of-bounds write happens when code writes data past the beginning or end of a buffer, corrupting adjacent memory. In memory-unsafe languages such as C and C++ this can overwrite return addresses, function pointers, heap metadata, or security-relevant variables, and it is one of the most reliable paths to remote code execution. It is the parent concept behind many buffer overflow variants and appears constantly in browser, kernel, and firmware vulnerabilities.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- An image parser trusts a width and height from the file header, allocates a buffer from them, then writes more pixel data than was allocated.
- An off-by-one loop condition (<= instead of <) writes one element past the end of an array and corrupts a neighbouring structure.
- A negative index derived from attacker input writes before the start of a buffer.
How to mitigate it
- Prefer memory-safe languages such as Rust, Go, Java, or C# for new code, especially parsers that handle untrusted input.
- Validate every length and index against the actual buffer size before writing, and use bounded functions or safe container types.
- Compile with stack canaries, FORTIFY_SOURCE, and control-flow protections, and rely on ASLR and DEP/NX to make exploitation harder.
- Fuzz parsers and protocol handlers continuously with sanitizers such as AddressSanitizer enabled.
Go deeper
Practice this topic
Test your knowledge of Out-of-bounds Write with exam-style practice questions.