Fallos del tipo CWE-122

3195 resultados

Estouro de heap

É quando o código escreve dados além dos limites de um buffer alocado no heap (memória dinâmica), sobrescrevendo dados de outras estruturas adjacentes. Esse estouro pode corromper metadados do heap, variáveis vizinhas ou objetos do programa, permitindo execução de código arbitrário ou negação de serviço.

Ejemplo

Um servidor web recebe uma string de tamanho arbitrário e a copia para um buffer de 256 bytes sem validar o comprimento (ex: strcpy em C). Se o atacante enviar 500 bytes, o restante escreve além da zona alocada, corrompendo estruturas próximas e potencialmente ganhando controle do fluxo.

Cómo mitigar

Use funções seguras (strncpy, strlcpy, snprintf em C) que respeitam limites de tamanho; valide e sanitize entrada do usuário antes de copiar; ative proteções do SO (ASLR, DEP/NX); use linguagens de memória segura quando possível; aplique verificações de limites em loops de cópia.

CVE-2024-38051HIGHWindows Graphics Component Remote Code Execution VulnerabilityEPSS 1.1%CVE-2025-21413HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.1%CVE-2025-21411HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.1%CVE-2025-21409HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.1%CVE-2026-41252CRITICALxrdp: lib_palette_update Heap Buffer Overflow & RCEEPSS 1.1%CVE-2025-21339HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.1%CVE-2025-62456HIGHWindows Resilient File System (ReFS) Remote Code Execution VulnerabilityEPSS 1.1%CVE-2021-21958HIGHA heap-based buffer overflow vulnerability exists in the Hword HwordApp.dll functionality of Hancom Office 2020 11.0.0.2353. A specially-craEPSS 1.1%CVE-2026-20922HIGHWindows NTFS Remote Code Execution VulnerabilityEPSS 1.1%CVE-2023-21783HIGH3D Builder Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-43480MEDIUMAzure Service Fabric for Linux Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-33429HIGHBuffer-Overflow vulnerability at pcm_convert.h:513 of phiola v2.0-rc22 allows a remote attacker to execute arbitrary code via a crafted .wavEPSS 1.1%CVE-2022-40655HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. UEPSS 1.1%CVE-2020-27752—A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick couEPSS 1.1%CVE-2023-21740HIGHWindows Media Remote Code Execution VulnerabilityEPSS 1.1%CVE-2021-21947CRITICALTwo heap-based buffer overflow vulnerabilities exists in the JPEG-JFIF lossless Huffman image parser functionality of Accusoft ImageGear 19.EPSS 1.1%CVE-2021-21944CRITICALTwo heap-based buffer overflow vulnerabilities exist in the TIFF parser functionality of Accusoft ImageGear 19.10. A specially-crafted file EPSS 1.1%CVE-2021-21946CRITICALTwo heap-based buffer overflow vulnerabilities exists in the JPEG-JFIF lossless Huffman image parser functionality of Accusoft ImageGear 19.EPSS 1.1%CVE-2021-21945CRITICALTwo heap-based buffer overflow vulnerabilities exist in the TIFF parser functionality of Accusoft ImageGear 19.10. A specially-crafted file EPSS 1.1%CVE-2025-33066HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.1%