Fallos del tipo CWE-122

3195 resultados

Estouro de heap

É quando o código escreve dados além dos limites de um buffer alocado no heap (memória dinâmica), sobrescrevendo dados de outras estruturas adjacentes. Esse estouro pode corromper metadados do heap, variáveis vizinhas ou objetos do programa, permitindo execução de código arbitrário ou negação de serviço.

Ejemplo

Um servidor web recebe uma string de tamanho arbitrário e a copia para um buffer de 256 bytes sem validar o comprimento (ex: strcpy em C). Se o atacante enviar 500 bytes, o restante escreve além da zona alocada, corrompendo estruturas próximas e potencialmente ganhando controle do fluxo.

Cómo mitigar

Use funções seguras (strncpy, strlcpy, snprintf em C) que respeitam limites de tamanho; valide e sanitize entrada do usuário antes de copiar; ative proteções do SO (ASLR, DEP/NX); use linguagens de memória segura quando possível; aplique verificações de limites em loops de cópia.

CVE-2019-13536—Delta Electronics TPEditor, Versions 1.94 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specEPSS 1.4%CVE-2018-1056LOWAn out-of-bounds heap buffer read flaw was found in the way advancecomp before 2.1-2018/02 handled processing of ZIP files. An attacker coulEPSS 1.4%CVE-2024-21886HIGHXorg-x11-server: heap buffer overflow in disabledeviceEPSS 1.4%CVE-2024-21885HIGHXorg-x11-server: heap buffer overflow in xisenddevicehierarchyeventEPSS 1.4%CVE-2024-38265HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.4%CVE-2021-31485HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2021-31478HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2021-31483HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2025-21303HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.4%CVE-2025-21305HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.4%CVE-2025-21252HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-43598HIGHLightGBM Remote Code Execution VulnerabilityEPSS 1.4%CVE-2025-21302HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.4%CVE-2025-21306HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-43607HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-43608HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-43564HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.4%CVE-2026-20868HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.4%CVE-2022-0080HIGHHeap-based Buffer Overflow in mruby/mrubyEPSS 1.4%CVE-2021-21795CRITICALA heap-based buffer overflow vulnerability exists in the PSD read_icc_icCurve_data functionality of Accusoft ImageGear 19.9. A specially craEPSS 1.4%