Weaknesses of type CWE-122

3,189 results

Transbordamento de heap (heap overflow)

Ocorre quando um programa escreve dados além dos limites de um buffer alocado dinamicamente na memória heap, sobrescrevendo dados adjacentes ou metadados do alocador. Isso permite que um atacante corrompa estruturas críticas, execute código arbitrário ou cause travamento da aplicação.

Example

Uma função recebe um tamanho de entrada sem validar e copia para um buffer: `strcpy(heap_buffer, user_input)` sem verificar se user_input cabe. Se o usuário enviar 1000 bytes para um buffer de 256, o overflow sobrescreve estruturas próximas no heap e pode ser explorado para RCE.

How to mitigate

Use funções seguras de cópia (`strncpy`, `strlcpy`), valide e limite o tamanho da entrada antes de copiar, e considere usar linguagens com gerenciamento automático de memória ou ferramentas como AddressSanitizer durante testes para detectar overflows.

CVE-2023-44442HIGHGIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 61.4%CVE-2024-10525HIGHEclipse Mosquito: Heap Buffer Overflow in my_subscribe_callbackEPSS 59.5%CVE-2024-38812CRITICALHeap-overflow vulnerabilityEPSS 54.6%KEVCVE-2020-24435HIGHAcrobat Reader DC Heap-based Buffer Overflow Could Lead to Arbitrary Code ExecutionEPSS 52.7%CVE-2019-5436HIGHA heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.EPSS 49.7%CVE-2023-28252HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 49.0%KEVCVE-2023-33133HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 44.0%CVE-2022-24834HIGHHeap overflow issue with the Lua cjson library used by RedisEPSS 41.1%CVE-2021-44708HIGHAdobe Acrobat Pro DC Heap Overflow could lead to Arbitrary code executionEPSS 38.2%CVE-2022-35712CRITICALAdobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 36.8%CVE-2023-28231HIGHDHCP Server Service Remote Code Execution VulnerabilityEPSS 36.6%CVE-2017-13090HIGHGNU Wget: heap overflow in HTTP protocol handlingEPSS 36.6%CVE-2025-47981CRITICALSPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution VulnerabilityEPSS 32.6%CVE-2024-24996CRITICALA Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to eEPSS 32.2%CVE-2019-3568CRITICALA buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a EPSS 30.1%KEVCVE-2025-40597HIGHA Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of SerEPSS 29.9%CVE-2021-44709HIGHAdobe Acrobat Pro DC Heap Overflow Vulnerability could lead to Arbitrary code executionEPSS 29.0%CVE-2023-21690CRITICALMicrosoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution VulnerabilityEPSS 27.5%CVE-2023-44441HIGHGIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 27.3%CVE-2024-4323CRITICALFluent Bit Memory Corruption VulnerabilityEPSS 27.2%