Fallos del tipo CWE-122

3202 resultados

Estouro de heap

É quando o código escreve dados além dos limites de um buffer alocado no heap (memória dinâmica), sobrescrevendo dados de outras estruturas adjacentes. Esse estouro pode corromper metadados do heap, variáveis vizinhas ou objetos do programa, permitindo execução de código arbitrário ou negação de serviço.

Ejemplo

Um servidor web recebe uma string de tamanho arbitrário e a copia para um buffer de 256 bytes sem validar o comprimento (ex: strcpy em C). Se o atacante enviar 500 bytes, o restante escreve além da zona alocada, corrompendo estruturas próximas e potencialmente ganhando controle do fluxo.

Cómo mitigar

Use funções seguras (strncpy, strlcpy, snprintf em C) que respeitam limites de tamanho; valide e sanitize entrada do usuário antes de copiar; ative proteções do SO (ASLR, DEP/NX); use linguagens de memória segura quando possível; aplique verificações de limites em loops de cópia.

CVE-2026-13072CRITICALMongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory CorruptionEPSS 0.4%CVE-2024-24335HIGHA heap buffer overflow occurs in the dfs_v2 romfs filesystem RT-Thread through 5.0.2.EPSS 0.4%CVE-2024-24334HIGHA heap buffer overflow occurs in dfs_v2 dfs_file in RT-Thread through 5.0.2.EPSS 0.4%CVE-2023-38080HIGHKofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-37344HIGHKofax Power PDF BMP File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-48131HIGHVPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number ZeroEPSS 0.4%CVE-2025-61944HIGHHeap-based Buffer Overflow Vulnerability in TP-Link Archer AX53EPSS 0.4%CVE-2025-58077HIGHHeap-based Buffer Overflow Vulnerability in TP-Link Archer AX53EPSS 0.4%CVE-2024-23154HIGHMultiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsEPSS 0.4%CVE-2025-59482HIGHHeap-based Buffer Overflow Vulnerability in TP-Link Archer AX53EPSS 0.4%CVE-2025-59487HIGHHeap-based Buffer Overflow Vulnerability in TP-Link Archer AX53EPSS 0.4%CVE-2025-58455HIGHHeap-based Buffer Overflow Vulnerability in TP-Link Archer AX53EPSS 0.4%CVE-2025-2308MEDIUMHDF5 Scale-Offset Filter H5Z__scaleoffset_decompress_one_byte heap-based overflowEPSS 0.4%CVE-2026-59187HIGHOpenEXR: exrmetrics deep pixelmode heap buffer overflowEPSS 0.4%CVE-2022-39068MEDIUMBuffer Overflow Vulnerability in ZTE MF296REPSS 0.4%CVE-2026-48135MEDIUMHTTP service can incorrectly process malformed HTTP requestsEPSS 0.4%CVE-2026-68580HIGHFreeRDP before 3.29.0 Integer Overflow via Audio Input ChannelEPSS 0.4%CVE-2026-3931HIGHHeap buffer overflow in Skia in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a EPSS 0.4%CVE-2025-57106HIGHKitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the BEPSS 0.4%CVE-2024-37001HIGHMultiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareEPSS 0.4%