Weaknesses of type CWE-122

3,192 results

Transbordamento de heap (heap overflow)

Ocorre quando um programa escreve dados além dos limites de um buffer alocado dinamicamente na memória heap, sobrescrevendo dados adjacentes ou metadados do alocador. Isso permite que um atacante corrompa estruturas críticas, execute código arbitrário ou cause travamento da aplicação.

Example

Uma função recebe um tamanho de entrada sem validar e copia para um buffer: `strcpy(heap_buffer, user_input)` sem verificar se user_input cabe. Se o usuário enviar 1000 bytes para um buffer de 256, o overflow sobrescreve estruturas próximas no heap e pode ser explorado para RCE.

How to mitigate

Use funções seguras de cópia (`strncpy`, `strlcpy`), valide e limite o tamanho da entrada antes de copiar, e considere usar linguagens com gerenciamento automático de memória ou ferramentas como AddressSanitizer durante testes para detectar overflows.

CVE-2024-49000HIGHSQL Server Native Client Remote Code Execution VulnerabilityEPSS 1.5%CVE-2024-49001HIGHSQL Server Native Client Remote Code Execution VulnerabilityEPSS 1.5%CVE-2024-49005HIGHSQL Server Native Client Remote Code Execution VulnerabilityEPSS 1.5%CVE-2025-27487HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 1.5%CVE-2023-28275HIGHMicrosoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityEPSS 1.5%CVE-2023-32324HIGHOpenPrinting CUPS vulnerable to heap buffer overflowEPSS 1.5%CVE-2025-24051HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.5%CVE-2024-43453HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.5%CVE-2025-1538HIGHD-Link DAP-1320 api set_ws_action heap-based overflowEPSS 1.5%CVE-2020-6147HIGHA heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. This instance EPSS 1.5%CVE-2022-2284HIGHHeap-based Buffer Overflow in vim/vimEPSS 1.4%CVE-2023-28254HIGHWindows DNS Server Remote Code Execution VulnerabilityEPSS 1.4%CVE-2023-35302HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-38212HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-43517HIGHMicrosoft ActiveX Data Objects Remote Code Execution VulnerabilityEPSS 1.4%CVE-2020-27841—There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be proceEPSS 1.4%CVE-2024-7055MEDIUMFFmpeg pnmdec.c pnm_decode_frame heap-based overflowEPSS 1.4%CVE-2024-38045HIGHWindows TCP/IP Remote Code Execution VulnerabilityEPSS 1.4%CVE-2019-10982—Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by EPSS 1.4%CVE-2019-13536—Delta Electronics TPEditor, Versions 1.94 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specEPSS 1.4%