Weaknesses of type CWE-122

3,189 results

Transbordamento de heap (heap overflow)

Ocorre quando um programa escreve dados além dos limites de um buffer alocado dinamicamente na memória heap, sobrescrevendo dados adjacentes ou metadados do alocador. Isso permite que um atacante corrompa estruturas críticas, execute código arbitrário ou cause travamento da aplicação.

Example

Uma função recebe um tamanho de entrada sem validar e copia para um buffer: `strcpy(heap_buffer, user_input)` sem verificar se user_input cabe. Se o usuário enviar 1000 bytes para um buffer de 256, o overflow sobrescreve estruturas próximas no heap e pode ser explorado para RCE.

How to mitigate

Use funções seguras de cópia (`strncpy`, `strlcpy`), valide e limite o tamanho da entrada antes de copiar, e considere usar linguagens com gerenciamento automático de memória ou ferramentas como AddressSanitizer durante testes para detectar overflows.

CVE-2020-27752—A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick couEPSS 1.1%CVE-2023-21740HIGHWindows Media Remote Code Execution VulnerabilityEPSS 1.1%CVE-2021-21946CRITICALTwo heap-based buffer overflow vulnerabilities exists in the JPEG-JFIF lossless Huffman image parser functionality of Accusoft ImageGear 19.EPSS 1.1%CVE-2021-21947CRITICALTwo heap-based buffer overflow vulnerabilities exists in the JPEG-JFIF lossless Huffman image parser functionality of Accusoft ImageGear 19.EPSS 1.1%CVE-2021-21944CRITICALTwo heap-based buffer overflow vulnerabilities exist in the TIFF parser functionality of Accusoft ImageGear 19.10. A specially-crafted file EPSS 1.1%CVE-2021-21945CRITICALTwo heap-based buffer overflow vulnerabilities exist in the TIFF parser functionality of Accusoft ImageGear 19.10. A specially-crafted file EPSS 1.1%CVE-2025-33066HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-22211LOWFreeRDP integer Overflow leading to Heap OverflowEPSS 1.1%CVE-2026-5201HIGHGdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg imageEPSS 1.1%CVE-2021-3756MEDIUMHeap-based Buffer Overflow in hoene/libmysofaEPSS 1.1%CVE-2021-33007—A heap-based buffer overflow in Delta Electronics TPEditor: v1.98.06 and prior may be exploited by processing a specially crafted project fiEPSS 1.1%CVE-2021-31954HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2023-32307HIGHheap-over-flow and integer-overflow in sofia-sipEPSS 1.1%CVE-2021-37199—A vulnerability has been identified in SINUMERIK 808D (All versions), SINUMERIK 828D (All versions < V4.95). Affected devices don't process EPSS 1.1%CVE-2024-33698CRITICALA vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (EPSS 1.1%CVE-2023-21695HIGHMicrosoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-32038CRITICALWazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-29963HIGHWindows Media Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-29964HIGHWindows Media Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-27752HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 1.0%