Weaknesses of type CWE-122

3,190 results

Transbordamento de heap (heap overflow)

Ocorre quando um programa escreve dados além dos limites de um buffer alocado dinamicamente na memória heap, sobrescrevendo dados adjacentes ou metadados do alocador. Isso permite que um atacante corrompa estruturas críticas, execute código arbitrário ou cause travamento da aplicação.

Example

Uma função recebe um tamanho de entrada sem validar e copia para um buffer: `strcpy(heap_buffer, user_input)` sem verificar se user_input cabe. Se o usuário enviar 1000 bytes para um buffer de 256, o overflow sobrescreve estruturas próximas no heap e pode ser explorado para RCE.

How to mitigate

Use funções seguras de cópia (`strncpy`, `strlcpy`), valide e limite o tamanho da entrada antes de copiar, e considere usar linguagens com gerenciamento automático de memória ou ferramentas como AddressSanitizer durante testes para detectar overflows.

CVE-2024-38065MEDIUMSecure Boot Security Feature Bypass VulnerabilityEPSS 0.9%CVE-2023-32138HIGHD-Link DAP-1360 webproc Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.9%CVE-2025-21180HIGHWindows exFAT File System Remote Code Execution VulnerabilityEPSS 0.9%CVE-2025-53853CRITICALA heap-based buffer overflow vulnerability exists in the ISHNE parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchEPSS 0.9%CVE-2023-32047HIGHPaint 3D Remote Code Execution VulnerabilityEPSS 0.9%CVE-2025-53511CRITICALA heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch EPSS 0.9%CVE-2023-21791HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-21785HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-21790HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-63090HIGHProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet ReassemblyEPSS 0.9%CVE-2026-69276CRITICALMicrosoft UxTheme Library (uxtheme.dll) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-21793HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-69431CRITICALTelnet Client Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-21786HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-21787HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-21781HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-32621CRITICALHDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5HG_read in H5HG.c (called from H5VL__native_blob_get in H5VLnative_blEPSS 0.9%CVE-2020-7852HIGHDaviewIndy Heap Overflow VulnerabilitiesEPSS 0.9%CVE-2022-43648HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 1.20B03 routers.EPSS 0.9%CVE-2022-20946HIGHA vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of Cisco Firepower Threat Defense (FTD) Software couEPSS 0.9%