Weaknesses of type CWE-122

3,195 results

Transbordamento de heap (heap overflow)

Ocorre quando um programa escreve dados além dos limites de um buffer alocado dinamicamente na memória heap, sobrescrevendo dados adjacentes ou metadados do alocador. Isso permite que um atacante corrompa estruturas críticas, execute código arbitrário ou cause travamento da aplicação.

Example

Uma função recebe um tamanho de entrada sem validar e copia para um buffer: `strcpy(heap_buffer, user_input)` sem verificar se user_input cabe. Se o usuário enviar 1000 bytes para um buffer de 256, o overflow sobrescreve estruturas próximas no heap e pode ser explorado para RCE.

How to mitigate

Use funções seguras de cópia (`strncpy`, `strlcpy`), valide e limite o tamanho da entrada antes de copiar, e considere usar linguagens com gerenciamento automático de memória ou ferramentas como AddressSanitizer durante testes para detectar overflows.

CVE-2024-26178HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2026-42533CRITICALNGINX Map directive and Regex matching vulnerabilityEPSS 0.9%CVE-2024-43587MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-38147HIGHWindows Miracast Wireless Display Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-39946HIGHHeap overflow in push_back_helper due to a CDR messageEPSS 0.9%CVE-2026-25173HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2025-24797CRITICALMeshtastic incorrectly hands malformed packets leads to controlled buffer overflowEPSS 0.9%CVE-2024-30075HIGHWindows Link Layer Topology Discovery Protocol Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-44178HIGHxrdp: Channel Data Forwarding Fixed-Size Buffer OverflowEPSS 0.9%CVE-2026-15422CRITICALSCTP needs to better-check INIT ACK chunk parametersEPSS 0.9%CVE-2024-38152HIGHWindows OLE Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-40504CRITICALCreolabs Gravity < 0.9.6 Heap Buffer Overflow via gravity_vm_execEPSS 0.9%CVE-2025-58447CRITICALrAthena has heap-based buffer overflow in login serverEPSS 0.9%CVE-2023-23384HIGHMicrosoft SQL Server Remote Code Execution VulnerabilityEPSS 0.9%CVE-2019-14814MEDIUMThere is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, thaEPSS 0.9%CVE-2024-32664MEDIUMSuricata's base64 contains an out of bounds writeEPSS 0.9%CVE-2024-30259HIGHFastDDS heap buffer overflow when publisher sends malformed packetEPSS 0.9%CVE-2024-29161HIGHHDF5 through 1.14.3 contains a heap buffer overflow in H5A__attr_release_table, resulting in the corruption of the instruction pointer and cEPSS 0.9%CVE-2024-38261HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-69439HIGH.NET and Visual Studio Elevation of Privilege VulnerabilityEPSS 0.9%