Fallos del tipo CWE-122

3190 resultados

Estouro de heap

É quando o código escreve dados além dos limites de um buffer alocado no heap (memória dinâmica), sobrescrevendo dados de outras estruturas adjacentes. Esse estouro pode corromper metadados do heap, variáveis vizinhas ou objetos do programa, permitindo execução de código arbitrário ou negação de serviço.

Ejemplo

Um servidor web recebe uma string de tamanho arbitrário e a copia para um buffer de 256 bytes sem validar o comprimento (ex: strcpy em C). Se o atacante enviar 500 bytes, o restante escreve além da zona alocada, corrompendo estruturas próximas e potencialmente ganhando controle do fluxo.

Cómo mitigar

Use funções seguras (strncpy, strlcpy, snprintf em C) que respeitam limites de tamanho; valide e sanitize entrada do usuário antes de copiar; ative proteções do SO (ASLR, DEP/NX); use linguagens de memória segura quando possível; aplique verificações de limites em loops de cópia.

CVE-2025-59295HIGHWindows URL Parsing Remote Code Execution VulnerabilityEPSS 1.9%CVE-2024-30017HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 1.9%CVE-2016-8654HIGHA heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versioEPSS 1.9%CVE-2025-49683HIGHMicrosoft Virtual Hard Disk Remote Code Execution VulnerabilityEPSS 1.9%CVE-2020-25843HIGHCHANGING Inc. NHIServiSignAdapter Windows Versions - Heap OverflowEPSS 1.9%CVE-2021-34312—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_loader.dll liEPSS 1.9%CVE-2021-34317—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_loader.dll libEPSS 1.9%CVE-2013-7353MEDIUMInteger overflow in the png_set_unknown_chunks function in libpng/pngset.c in libpng before 1.5.14beta08 allows context-dependent attackers EPSS 1.9%CVE-2021-41253MEDIUMPossible heap buffer overflow when using zycore string functions in formatter hooksEPSS 1.9%CVE-2024-37318HIGHSQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityEPSS 1.9%CVE-2024-21414HIGHSQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityEPSS 1.9%CVE-2024-35272HIGHSQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityEPSS 1.9%CVE-2024-37331HIGHSQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityEPSS 1.9%CVE-2024-21398HIGHSQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityEPSS 1.9%CVE-2022-41794CRITICALA heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. A specially-crafted PSEPSS 1.9%CVE-2024-35271HIGHSQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityEPSS 1.9%CVE-2024-37332HIGHSQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityEPSS 1.9%CVE-2022-43597HIGHMultiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.EPSS 1.8%CVE-2025-21407HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.8%CVE-2025-21410HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.8%