Weaknesses of type CWE-122

3,189 results

Transbordamento de heap (heap overflow)

Ocorre quando um programa escreve dados além dos limites de um buffer alocado dinamicamente na memória heap, sobrescrevendo dados adjacentes ou metadados do alocador. Isso permite que um atacante corrompa estruturas críticas, execute código arbitrário ou cause travamento da aplicação.

Example

Uma função recebe um tamanho de entrada sem validar e copia para um buffer: `strcpy(heap_buffer, user_input)` sem verificar se user_input cabe. Se o usuário enviar 1000 bytes para um buffer de 256, o overflow sobrescreve estruturas próximas no heap e pode ser explorado para RCE.

How to mitigate

Use funções seguras de cópia (`strncpy`, `strlcpy`), valide e limite o tamanho da entrada antes de copiar, e considere usar linguagens com gerenciamento automático de memória ou ferramentas como AddressSanitizer durante testes para detectar overflows.

CVE-2020-6147HIGHA heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. This instance EPSS 1.5%CVE-2022-2284HIGHHeap-based Buffer Overflow in vim/vimEPSS 1.4%CVE-2023-28254HIGHWindows DNS Server Remote Code Execution VulnerabilityEPSS 1.4%CVE-2023-35302HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-38212HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-43517HIGHMicrosoft ActiveX Data Objects Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-7055MEDIUMFFmpeg pnmdec.c pnm_decode_frame heap-based overflowEPSS 1.4%CVE-2020-27841—There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be proceEPSS 1.4%CVE-2024-38045HIGHWindows TCP/IP Remote Code Execution VulnerabilityEPSS 1.4%CVE-2019-10982—Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by EPSS 1.4%CVE-2019-13536—Delta Electronics TPEditor, Versions 1.94 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specEPSS 1.4%CVE-2026-42512HIGHRemotely triggerable out-of-bounds heap write in dhclientEPSS 1.4%CVE-2018-1056LOWAn out-of-bounds heap buffer read flaw was found in the way advancecomp before 2.1-2018/02 handled processing of ZIP files. An attacker coulEPSS 1.4%CVE-2024-21886HIGHXorg-x11-server: heap buffer overflow in disabledeviceEPSS 1.4%CVE-2024-21885HIGHXorg-x11-server: heap buffer overflow in xisenddevicehierarchyeventEPSS 1.4%CVE-2021-31483HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2021-31478HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2021-31485HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2024-38265HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.4%CVE-2025-21302HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.4%