Weaknesses of type CWE-122

3,189 results

Transbordamento de heap (heap overflow)

Ocorre quando um programa escreve dados além dos limites de um buffer alocado dinamicamente na memória heap, sobrescrevendo dados adjacentes ou metadados do alocador. Isso permite que um atacante corrompa estruturas críticas, execute código arbitrário ou cause travamento da aplicação.

Example

Uma função recebe um tamanho de entrada sem validar e copia para um buffer: `strcpy(heap_buffer, user_input)` sem verificar se user_input cabe. Se o usuário enviar 1000 bytes para um buffer de 256, o overflow sobrescreve estruturas próximas no heap e pode ser explorado para RCE.

How to mitigate

Use funções seguras de cópia (`strncpy`, `strlcpy`), valide e limite o tamanho da entrada antes de copiar, e considere usar linguagens com gerenciamento automático de memória ou ferramentas como AddressSanitizer durante testes para detectar overflows.

CVE-2024-21369HIGHMicrosoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityEPSS 1.5%CVE-2021-3875HIGHHeap-based Buffer Overflow in vim/vimEPSS 1.5%CVE-2023-36532MEDIUMBuffer overflow in Zoom Clients before 5.14.5 may allow an unauthenticated user to enable a denial of service via network access.EPSS 1.5%CVE-2025-27477HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.5%CVE-2022-2182HIGHHeap-based Buffer Overflow in vim/vimEPSS 1.5%CVE-2024-24577HIGHlibgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add`EPSS 1.5%CVE-2025-24056HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.5%CVE-2023-27395CRITICALA heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674EPSS 1.5%CVE-2022-0417HIGHHeap-based Buffer Overflow in vim/vimEPSS 1.5%CVE-2024-49125HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.5%CVE-2020-13586HIGHA memory corruption vulnerability exists in the Excel Document SST Record 0x00fc functionality of SoftMaker Software GmbH SoftMaker Office PEPSS 1.5%CVE-2022-0392MEDIUMHeap-based Buffer Overflow in vim/vimEPSS 1.5%CVE-2023-51596HIGHBlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.5%CVE-2022-22188HIGHJunos OS: QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series: When storm control profiling is enabled and a device is under an active storm, a Heap-based Buffer Overflow in the PFE will cause a device to hang.EPSS 1.5%CVE-2021-45918HIGHNHI’s health insurance web service component – Heap-based Buffer OverflowEPSS 1.5%CVE-2021-29464LOWHeap buffer overflow in Exiv2::Jp2Image::encodeJp2HeaderEPSS 1.5%CVE-2024-49775CRITICALA vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V250EPSS 1.5%CVE-2018-3858HIGHAn exploitable heap overflow exists in the TIFF parsing functionality of Canvas Draw version 4.0.0. A specially crafted TIFF image processedEPSS 1.5%CVE-2021-3872HIGHHeap-based Buffer Overflow in vim/vimEPSS 1.5%CVE-2023-50230HIGHBlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.5%