Fallos del tipo CWE-122

3192 resultados

Estouro de heap

É quando o código escreve dados além dos limites de um buffer alocado no heap (memória dinâmica), sobrescrevendo dados de outras estruturas adjacentes. Esse estouro pode corromper metadados do heap, variáveis vizinhas ou objetos do programa, permitindo execução de código arbitrário ou negação de serviço.

Ejemplo

Um servidor web recebe uma string de tamanho arbitrário e a copia para um buffer de 256 bytes sem validar o comprimento (ex: strcpy em C). Se o atacante enviar 500 bytes, o restante escreve além da zona alocada, corrompendo estruturas próximas e potencialmente ganhando controle do fluxo.

Cómo mitigar

Use funções seguras (strncpy, strlcpy, snprintf em C) que respeitam limites de tamanho; valide e sanitize entrada do usuário antes de copiar; ative proteções do SO (ASLR, DEP/NX); use linguagens de memória segura quando possível; aplique verificações de limites em loops de cópia.

CVE-2020-13586HIGHA memory corruption vulnerability exists in the Excel Document SST Record 0x00fc functionality of SoftMaker Software GmbH SoftMaker Office PEPSS 1.5%CVE-2026-27654HIGHNGINX ngx_http_dav_module vulnerabilityEPSS 1.5%CVE-2022-0392MEDIUMHeap-based Buffer Overflow in vim/vimEPSS 1.5%CVE-2023-51596HIGHBlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.5%CVE-2022-22188HIGHJunos OS: QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series: When storm control profiling is enabled and a device is under an active storm, a Heap-based Buffer Overflow in the PFE will cause a device to hang.EPSS 1.5%CVE-2021-45918HIGHNHI’s health insurance web service component – Heap-based Buffer OverflowEPSS 1.5%CVE-2024-49775CRITICALA vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V250EPSS 1.5%CVE-2021-29464LOWHeap buffer overflow in Exiv2::Jp2Image::encodeJp2HeaderEPSS 1.5%CVE-2018-3858HIGHAn exploitable heap overflow exists in the TIFF parsing functionality of Canvas Draw version 4.0.0. A specially crafted TIFF image processedEPSS 1.5%CVE-2021-3872HIGHHeap-based Buffer Overflow in vim/vimEPSS 1.5%CVE-2023-50230HIGHBlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.5%CVE-2025-21248HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.5%CVE-2025-21239HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.5%CVE-2025-21241HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.5%CVE-2024-43589HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.5%CVE-2023-36425HIGHWindows Distributed File System (DFS) Remote Code Execution VulnerabilityEPSS 1.5%CVE-2022-41991CRITICALA heap-based buffer overflow vulnerability exists in the m2m DELETE_FILE cmd functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A EPSS 1.5%CVE-2020-28595HIGHAn out-of-bounds write vulnerability exists in the Obj.cpp load_obj() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4EPSS 1.5%CVE-2024-49005HIGHSQL Server Native Client Remote Code Execution VulnerabilityEPSS 1.5%CVE-2024-49004HIGHSQL Server Native Client Remote Code Execution VulnerabilityEPSS 1.5%