Fallos del tipo CWE-122

3195 resultados

Estouro de heap

É quando o código escreve dados além dos limites de um buffer alocado no heap (memória dinâmica), sobrescrevendo dados de outras estruturas adjacentes. Esse estouro pode corromper metadados do heap, variáveis vizinhas ou objetos do programa, permitindo execução de código arbitrário ou negação de serviço.

Ejemplo

Um servidor web recebe uma string de tamanho arbitrário e a copia para um buffer de 256 bytes sem validar o comprimento (ex: strcpy em C). Se o atacante enviar 500 bytes, o restante escreve além da zona alocada, corrompendo estruturas próximas e potencialmente ganhando controle do fluxo.

Cómo mitigar

Use funções seguras (strncpy, strlcpy, snprintf em C) que respeitam limites de tamanho; valide e sanitize entrada do usuário antes de copiar; ative proteções do SO (ASLR, DEP/NX); use linguagens de memória segura quando possível; aplique verificações de limites em loops de cópia.

CVE-2026-69769CRITICALWindows HTTP Print Provider Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-69491CRITICALMicrosoft DirectMusic Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-65791CRITICALWindows iSCSI Target Service Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-78509CRITICALMicrosoft Office Outlook Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-50518CRITICALWindows DHCP Server Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-69715CRITICALWindows Direct Show Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-45657CRITICALWindows Kernel Remote Code Execution VulnerabilityEPSS 1.0%CVE-2022-21214HIGHICSA-22-090-03 Fuji Electric Alpha5EPSS 1.0%CVE-2021-38415HIGHFuji Electric Tellus Lite V-Simulator heap based buffer overflowEPSS 1.0%CVE-2025-49717HIGHMicrosoft SQL Server Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-1052HIGHMintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-3207MEDIUMermig1979 Simd SimdMemoryStream.h ReadUnsigned heap-based overflowEPSS 1.0%CVE-2023-36598HIGHMicrosoft WDAC ODBC Driver Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-67191CRITICALXlight FTP Server < 3.9.5 Pre-Auth Heap Buffer Overflow via SSH ParserEPSS 1.0%CVE-2023-5908CRITICALHeap Based Buffer Overflow in PTC KEPServerExEPSS 1.0%CVE-2026-81642CRITICALHeap buffer overflow and possible Remote Code Execution when digesting DNSKEYEPSS 1.0%CVE-2023-39947HIGHAnother heap overflow in push_back_helperEPSS 1.0%CVE-2025-49657HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2018-4833—A vulnerability has been identified in RFID 181EIP (All versions), RUGGEDCOM Win (V4.4, V4.5, V5.0, and V5.1), SCALANCE X-200 switch family EPSS 1.0%CVE-2023-24948HIGHWindows Bluetooth Driver Elevation of Privilege VulnerabilityEPSS 1.0%