Fallos del tipo CWE-122

3195 resultados

Estouro de heap

É quando o código escreve dados além dos limites de um buffer alocado no heap (memória dinâmica), sobrescrevendo dados de outras estruturas adjacentes. Esse estouro pode corromper metadados do heap, variáveis vizinhas ou objetos do programa, permitindo execução de código arbitrário ou negação de serviço.

Ejemplo

Um servidor web recebe uma string de tamanho arbitrário e a copia para um buffer de 256 bytes sem validar o comprimento (ex: strcpy em C). Se o atacante enviar 500 bytes, o restante escreve além da zona alocada, corrompendo estruturas próximas e potencialmente ganhando controle do fluxo.

Cómo mitigar

Use funções seguras (strncpy, strlcpy, snprintf em C) que respeitam limites de tamanho; valide e sanitize entrada do usuário antes de copiar; ative proteções do SO (ASLR, DEP/NX); use linguagens de memória segura quando possível; aplique verificações de limites em loops de cópia.

CVE-2024-26178HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2026-42533CRITICALNGINX Map directive and Regex matching vulnerabilityEPSS 0.9%CVE-2024-43587MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-38147HIGHWindows Miracast Wireless Display Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-39946HIGHHeap overflow in push_back_helper due to a CDR messageEPSS 0.9%CVE-2026-25173HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2025-24797CRITICALMeshtastic incorrectly hands malformed packets leads to controlled buffer overflowEPSS 0.9%CVE-2024-30075HIGHWindows Link Layer Topology Discovery Protocol Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-44178HIGHxrdp: Channel Data Forwarding Fixed-Size Buffer OverflowEPSS 0.9%CVE-2026-15422CRITICALSCTP needs to better-check INIT ACK chunk parametersEPSS 0.9%CVE-2024-38152HIGHWindows OLE Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-40504CRITICALCreolabs Gravity < 0.9.6 Heap Buffer Overflow via gravity_vm_execEPSS 0.9%CVE-2025-58447CRITICALrAthena has heap-based buffer overflow in login serverEPSS 0.9%CVE-2023-23384HIGHMicrosoft SQL Server Remote Code Execution VulnerabilityEPSS 0.9%CVE-2019-14814MEDIUMThere is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, thaEPSS 0.9%CVE-2024-32664MEDIUMSuricata's base64 contains an out of bounds writeEPSS 0.9%CVE-2024-30259HIGHFastDDS heap buffer overflow when publisher sends malformed packetEPSS 0.9%CVE-2024-29161HIGHHDF5 through 1.14.3 contains a heap buffer overflow in H5A__attr_release_table, resulting in the corruption of the instruction pointer and cEPSS 0.9%CVE-2024-38261HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-69439HIGH.NET and Visual Studio Elevation of Privilege VulnerabilityEPSS 0.9%