Fallos del tipo CWE-122

3190 resultados

Estouro de heap

É quando o código escreve dados além dos limites de um buffer alocado no heap (memória dinâmica), sobrescrevendo dados de outras estruturas adjacentes. Esse estouro pode corromper metadados do heap, variáveis vizinhas ou objetos do programa, permitindo execução de código arbitrário ou negação de serviço.

Ejemplo

Um servidor web recebe uma string de tamanho arbitrário e a copia para um buffer de 256 bytes sem validar o comprimento (ex: strcpy em C). Se o atacante enviar 500 bytes, o restante escreve além da zona alocada, corrompendo estruturas próximas e potencialmente ganhando controle do fluxo.

Cómo mitigar

Use funções seguras (strncpy, strlcpy, snprintf em C) que respeitam limites de tamanho; valide e sanitize entrada do usuário antes de copiar; ative proteções do SO (ASLR, DEP/NX); use linguagens de memória segura quando possível; aplique verificações de limites em loops de cópia.

CVE-2021-4136HIGHHeap-based Buffer Overflow in vim/vimEPSS 1.8%CVE-2025-21200HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.8%CVE-2025-21208HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.8%CVE-2025-21190HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-38116HIGHWindows IP Routing Management Snapin Remote Code Execution VulnerabilityEPSS 1.8%CVE-2018-3857HIGHAn exploitable heap overflow exists in the TIFF parsing functionality of Canvas Draw version 4.0.0. A specially crafted TIFF image processedEPSS 1.8%CVE-2024-43611HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.8%CVE-2025-21172HIGH.NET and Visual Studio Remote Code Execution VulnerabilityEPSS 1.8%CVE-2026-42512HIGHRemotely triggerable out-of-bounds heap write in dhclientEPSS 1.8%CVE-2022-41639CRITICALA heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branch-9aeece7a and v2.3.EPSS 1.8%CVE-2022-41838CRITICALA code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially-craEPSS 1.8%CVE-2022-43598HIGHMultiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.EPSS 1.8%CVE-2024-26179HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-26205HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-26200HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-30077HIGHWindows OLE Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-34459HIGHAn issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout cEPSS 1.8%CVE-2021-44000—A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (AlEPSS 1.8%CVE-2024-21795CRITICALA heap-based buffer overflow vulnerability exists in the .egi parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch EPSS 1.8%CVE-2024-21333HIGHSQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityEPSS 1.8%