Fallos del tipo CWE-122

3190 resultados

Estouro de heap

É quando o código escreve dados além dos limites de um buffer alocado no heap (memória dinâmica), sobrescrevendo dados de outras estruturas adjacentes. Esse estouro pode corromper metadados do heap, variáveis vizinhas ou objetos do programa, permitindo execução de código arbitrário ou negação de serviço.

Ejemplo

Um servidor web recebe uma string de tamanho arbitrário e a copia para um buffer de 256 bytes sem validar o comprimento (ex: strcpy em C). Se o atacante enviar 500 bytes, o restante escreve além da zona alocada, corrompendo estruturas próximas e potencialmente ganhando controle do fluxo.

Cómo mitigar

Use funções seguras (strncpy, strlcpy, snprintf em C) que respeitam limites de tamanho; valide e sanitize entrada do usuário antes de copiar; ative proteções do SO (ASLR, DEP/NX); use linguagens de memória segura quando possível; aplique verificações de limites em loops de cópia.

CVE-2023-21689CRITICALMicrosoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution VulnerabilityEPSS 26.5%CVE-2022-0572HIGHHeap-based Buffer Overflow in vim/vimEPSS 26.5%CVE-2024-49138HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 26.2%KEVCVE-2019-10192HIGHA heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.xEPSS 26.0%CVE-2014-0781—Yokogawa CENTUM CS 3000 Heap-based Buffer OverflowEPSS 25.4%CVE-2026-27654HIGHNGINX ngx_http_dav_module vulnerabilityEPSS 25.1%CVE-2021-20043—A Heap-based buffer overflow vulnerability in SonicWall SMA100 getBookmarks method allows a remote authenticated attacker to potentially exeEPSS 23.3%CVE-2026-47291CRITICALHTTP.sys Remote Code Execution VulnerabilityEPSS 22.8%CVE-2025-54574CRITICALSquid's URN Handling can lead to Buffer OverflowEPSS 22.7%CVE-2022-38742HIGHRockwell Automation ThinManager Software Vulnerable to Arbitrary Code Execution and Denial-Of-Service AttackEPSS 22.2%CVE-2023-21692CRITICALMicrosoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution VulnerabilityEPSS 21.2%CVE-2024-21345HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 20.4%CVE-2022-43634CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required tEPSS 18.9%CVE-2024-1283HIGHHeap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via aEPSS 18.7%CVE-2019-5482CRITICALHeap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.EPSS 17.9%CVE-2019-14901HIGHA heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerabiliEPSS 16.9%CVE-2023-36036HIGHWindows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityEPSS 16.7%KEVCVE-2021-32626HIGHLua scripts can overflow the heap-based Lua stack in RedisEPSS 16.2%CVE-2024-38060HIGHWindows Imaging Component Remote Code Execution VulnerabilityEPSS 15.9%CVE-2026-45657CRITICALWindows Kernel Remote Code Execution VulnerabilityEPSS 15.5%