Weaknesses of type CWE-122

3,188 results

Transbordamento de heap (heap overflow)

Ocorre quando um programa escreve dados além dos limites de um buffer alocado dinamicamente na memória heap, sobrescrevendo dados adjacentes ou metadados do alocador. Isso permite que um atacante corrompa estruturas críticas, execute código arbitrário ou cause travamento da aplicação.

Example

Uma função recebe um tamanho de entrada sem validar e copia para um buffer: `strcpy(heap_buffer, user_input)` sem verificar se user_input cabe. Se o usuário enviar 1000 bytes para um buffer de 256, o overflow sobrescreve estruturas próximas no heap e pode ser explorado para RCE.

How to mitigate

Use funções seguras de cópia (`strncpy`, `strlcpy`), valide e limite o tamanho da entrada antes de copiar, e considere usar linguagens com gerenciamento automático de memória ou ferramentas como AddressSanitizer durante testes para detectar overflows.

CVE-2024-21370HIGHMicrosoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-21360HIGHMicrosoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-21366HIGHMicrosoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-21358HIGHMicrosoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityEPSS 1.8%CVE-2018-6345—The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal EPSS 1.7%CVE-2023-45318CRITICALA heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004. A speciallEPSS 1.7%CVE-2023-36577HIGHMicrosoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityEPSS 1.7%CVE-2021-3778HIGHHeap-based Buffer Overflow in vim/vimEPSS 1.7%CVE-2024-49080HIGHWindows IP Routing Management Snapin Remote Code Execution VulnerabilityEPSS 1.7%CVE-2020-25226—A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT sEPSS 1.7%CVE-2021-3927HIGHHeap-based Buffer Overflow in vim/vimEPSS 1.7%CVE-2025-47987HIGHCredential Security Support Provider Protocol (CredSSP) Elevation of Privilege VulnerabilityEPSS 1.7%CVE-2022-0158MEDIUMHeap-based Buffer Overflow in vim/vimEPSS 1.7%CVE-2025-21171HIGH.NET Remote Code Execution VulnerabilityEPSS 1.7%CVE-2023-25181CRITICALA heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted EPSS 1.7%CVE-2024-49102HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.7%CVE-2024-49104HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.7%CVE-2025-21238HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.7%CVE-2025-21236HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.7%CVE-2025-21250HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.7%