Fallos del tipo CWE-122

3203 resultados

Estouro de heap

É quando o código escreve dados além dos limites de um buffer alocado no heap (memória dinâmica), sobrescrevendo dados de outras estruturas adjacentes. Esse estouro pode corromper metadados do heap, variáveis vizinhas ou objetos do programa, permitindo execução de código arbitrário ou negação de serviço.

Ejemplo

Um servidor web recebe uma string de tamanho arbitrário e a copia para um buffer de 256 bytes sem validar o comprimento (ex: strcpy em C). Se o atacante enviar 500 bytes, o restante escreve além da zona alocada, corrompendo estruturas próximas e potencialmente ganhando controle do fluxo.

Cómo mitigar

Use funções seguras (strncpy, strlcpy, snprintf em C) que respeitam limites de tamanho; valide e sanitize entrada do usuário antes de copiar; ative proteções do SO (ASLR, DEP/NX); use linguagens de memória segura quando possível; aplique verificações de limites em loops de cópia.

CVE-2025-57638HIGHBuffer overflow vulnerability in Tenda AC9 1.0 via the user supplied sys.vendor configuration value.EPSS 0.4%CVE-2025-50617HIGHA buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046ed68 function of the cgitest.cgi file. AttackeEPSS 0.4%CVE-2023-25868HIGHAdobe Substance 3D Stager SVG File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-25864HIGHAdobe Substance 3D Stager FBX File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-49528HIGHBuffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of EPSS 0.4%CVE-2024-51737HIGHRediSearch Integer Overflow with LIMIT or KNN arguments can lead to RCEEPSS 0.4%CVE-2023-22236HIGHAdobe Animate Heap-based Buffer Overflow Arbitrary code executionEPSS 0.4%CVE-2023-25874HIGHAdobe Substance 3D Stager SVG File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-1145MEDIUMquickjs-ng quickjs quickjs.c js_typed_array_constructor_ta heap-based overflowEPSS 0.4%CVE-2026-3845HIGHHeap buffer overflow in the Audio/Video: Playback component in Firefox for AndroidEPSS 0.4%CVE-2021-25449MEDIUMAn improper input validation vulnerability in libsapeextractor library prior to SMR Sep-2021 Release 1 allows attackers to execute arbitraryEPSS 0.4%CVE-2026-56189HIGHMicrosoft Windows Media Foundation Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-48723LOWQsync CentralEPSS 0.4%CVE-2025-48724LOWQsync CentralEPSS 0.4%CVE-2023-47042HIGHZDI-CAN-21696: Adobe Media Encoder MP4 File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-21528HIGHMicrosoft SQL Server Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-54241HIGHlibde265: SAO sequential filter heap buffer overflow via signed integer overflowEPSS 0.4%CVE-2025-52870LOWQsync CentralEPSS 0.4%CVE-2026-23665HIGHLinux Azure Diagnostic extension (LAD) Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2023-39494HIGHPDF-XChange Editor OXPS File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.4%