Weaknesses of type CWE-122

3,195 results

Transbordamento de heap (heap overflow)

Ocorre quando um programa escreve dados além dos limites de um buffer alocado dinamicamente na memória heap, sobrescrevendo dados adjacentes ou metadados do alocador. Isso permite que um atacante corrompa estruturas críticas, execute código arbitrário ou cause travamento da aplicação.

Example

Uma função recebe um tamanho de entrada sem validar e copia para um buffer: `strcpy(heap_buffer, user_input)` sem verificar se user_input cabe. Se o usuário enviar 1000 bytes para um buffer de 256, o overflow sobrescreve estruturas próximas no heap e pode ser explorado para RCE.

How to mitigate

Use funções seguras de cópia (`strncpy`, `strlcpy`), valide e limite o tamanho da entrada antes de copiar, e considere usar linguagens com gerenciamento automático de memória ou ferramentas como AddressSanitizer durante testes para detectar overflows.

CVE-2023-1448MEDIUMGPAC mpegts.c gf_m2ts_process_sdt heap-based overflowEPSS 0.4%CVE-2023-38080HIGHKofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-24335HIGHA heap buffer overflow occurs in the dfs_v2 romfs filesystem RT-Thread through 5.0.2.EPSS 0.4%CVE-2024-24334HIGHA heap buffer overflow occurs in dfs_v2 dfs_file in RT-Thread through 5.0.2.EPSS 0.4%CVE-2026-48131HIGHVPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number ZeroEPSS 0.4%CVE-2025-59482HIGHHeap-based Buffer Overflow Vulnerability in TP-Link Archer AX53EPSS 0.4%CVE-2025-58455HIGHHeap-based Buffer Overflow Vulnerability in TP-Link Archer AX53EPSS 0.4%CVE-2025-59487HIGHHeap-based Buffer Overflow Vulnerability in TP-Link Archer AX53EPSS 0.4%CVE-2025-58077HIGHHeap-based Buffer Overflow Vulnerability in TP-Link Archer AX53EPSS 0.4%CVE-2025-61944HIGHHeap-based Buffer Overflow Vulnerability in TP-Link Archer AX53EPSS 0.4%CVE-2024-23154HIGHMultiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsEPSS 0.4%CVE-2026-59187HIGHOpenEXR: exrmetrics deep pixelmode heap buffer overflowEPSS 0.4%CVE-2022-39068MEDIUMBuffer Overflow Vulnerability in ZTE MF296REPSS 0.4%CVE-2026-48135MEDIUMHTTP service can incorrectly process malformed HTTP requestsEPSS 0.4%CVE-2025-2308MEDIUMHDF5 Scale-Offset Filter H5Z__scaleoffset_decompress_one_byte heap-based overflowEPSS 0.4%CVE-2024-37001HIGHMultiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareEPSS 0.4%CVE-2026-3931HIGHHeap buffer overflow in Skia in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a EPSS 0.4%CVE-2026-68580HIGHFreeRDP before 3.29.0 Integer Overflow via Audio Input ChannelEPSS 0.4%CVE-2026-14385HIGHHeap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to perform out of bounds memory accesEPSS 0.4%CVE-2025-57106HIGHKitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the BEPSS 0.4%