Weaknesses of type CWE-122

3,188 results

Transbordamento de heap (heap overflow)

Ocorre quando um programa escreve dados além dos limites de um buffer alocado dinamicamente na memória heap, sobrescrevendo dados adjacentes ou metadados do alocador. Isso permite que um atacante corrompa estruturas críticas, execute código arbitrário ou cause travamento da aplicação.

Example

Uma função recebe um tamanho de entrada sem validar e copia para um buffer: `strcpy(heap_buffer, user_input)` sem verificar se user_input cabe. Se o usuário enviar 1000 bytes para um buffer de 256, o overflow sobrescreve estruturas próximas no heap e pode ser explorado para RCE.

How to mitigate

Use funções seguras de cópia (`strncpy`, `strlcpy`), valide e limite o tamanho da entrada antes de copiar, e considere usar linguagens com gerenciamento automático de memória ou ferramentas como AddressSanitizer durante testes para detectar overflows.

CVE-2023-44429HIGHGStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 2.2%CVE-2025-21369HIGHMicrosoft Digest Authentication Remote Code Execution VulnerabilityEPSS 2.2%CVE-2025-21368HIGHMicrosoft Digest Authentication Remote Code Execution VulnerabilityEPSS 2.2%CVE-2024-38076CRITICALWindows Remote Desktop Licensing Service Remote Code Execution VulnerabilityEPSS 2.2%CVE-2021-29457—Heap buffer overflow in Exiv2::Jp2Image::doWriteMetadataEPSS 2.2%CVE-2021-34326—A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization EPSS 2.1%CVE-2021-34328—A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization EPSS 2.1%CVE-2021-34329—A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization EPSS 2.1%CVE-2021-34905HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2021-34907HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2021-34900HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2021-34896HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2021-34893HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2020-6007—Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL stringEPSS 2.1%CVE-2021-46603HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2021-46605HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2021-34904HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2019-6539—Several heap-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior have been identified, which may allow arbitEPSS 2.1%CVE-2026-62741HIGHWindows HTTP.sys Elevation of Privilege VulnerabilityEPSS 2.1%CVE-2026-61930HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 2.1%