Fallos del tipo CWE-122

3190 resultados

Estouro de heap

É quando o código escreve dados além dos limites de um buffer alocado no heap (memória dinâmica), sobrescrevendo dados de outras estruturas adjacentes. Esse estouro pode corromper metadados do heap, variáveis vizinhas ou objetos do programa, permitindo execução de código arbitrário ou negação de serviço.

Ejemplo

Um servidor web recebe uma string de tamanho arbitrário e a copia para um buffer de 256 bytes sem validar o comprimento (ex: strcpy em C). Se o atacante enviar 500 bytes, o restante escreve além da zona alocada, corrompendo estruturas próximas e potencialmente ganhando controle do fluxo.

Cómo mitigar

Use funções seguras (strncpy, strlcpy, snprintf em C) que respeitam limites de tamanho; valide e sanitize entrada do usuário antes de copiar; ative proteções do SO (ASLR, DEP/NX); use linguagens de memória segura quando possível; aplique verificações de limites em loops de cópia.

CVE-2023-44442HIGHGIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 61.4%CVE-2024-10525HIGHEclipse Mosquito: Heap Buffer Overflow in my_subscribe_callbackEPSS 59.5%CVE-2024-38812CRITICALHeap-overflow vulnerabilityEPSS 54.6%KEVCVE-2020-24435HIGHAcrobat Reader DC Heap-based Buffer Overflow Could Lead to Arbitrary Code ExecutionEPSS 52.7%CVE-2019-5436HIGHA heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.EPSS 49.7%CVE-2023-28252HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 49.0%KEVCVE-2023-33133HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 44.0%CVE-2022-24834HIGHHeap overflow issue with the Lua cjson library used by RedisEPSS 41.1%CVE-2021-44708HIGHAdobe Acrobat Pro DC Heap Overflow could lead to Arbitrary code executionEPSS 38.2%CVE-2022-35712CRITICALAdobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 36.8%CVE-2023-28231HIGHDHCP Server Service Remote Code Execution VulnerabilityEPSS 36.6%CVE-2017-13090HIGHGNU Wget: heap overflow in HTTP protocol handlingEPSS 36.6%CVE-2025-47981CRITICALSPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution VulnerabilityEPSS 32.6%CVE-2024-24996CRITICALA Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to eEPSS 32.2%CVE-2019-3568CRITICALA buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a EPSS 30.1%KEVCVE-2025-40597HIGHA Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of SerEPSS 29.9%CVE-2021-44709HIGHAdobe Acrobat Pro DC Heap Overflow Vulnerability could lead to Arbitrary code executionEPSS 29.0%CVE-2023-21690CRITICALMicrosoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution VulnerabilityEPSS 27.5%CVE-2023-44441HIGHGIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 27.3%CVE-2024-4323CRITICALFluent Bit Memory Corruption VulnerabilityEPSS 27.2%