Fallos del tipo CWE-122

3195 resultados

Estouro de heap

É quando o código escreve dados além dos limites de um buffer alocado no heap (memória dinâmica), sobrescrevendo dados de outras estruturas adjacentes. Esse estouro pode corromper metadados do heap, variáveis vizinhas ou objetos do programa, permitindo execução de código arbitrário ou negação de serviço.

Ejemplo

Um servidor web recebe uma string de tamanho arbitrário e a copia para um buffer de 256 bytes sem validar o comprimento (ex: strcpy em C). Se o atacante enviar 500 bytes, o restante escreve além da zona alocada, corrompendo estruturas próximas e potencialmente ganhando controle do fluxo.

Cómo mitigar

Use funções seguras (strncpy, strlcpy, snprintf em C) que respeitam limites de tamanho; valide e sanitize entrada do usuário antes de copiar; ative proteções do SO (ASLR, DEP/NX); use linguagens de memória segura quando possível; aplique verificações de limites em loops de cópia.

CVE-2023-36042MEDIUMVisual Studio Denial of Service VulnerabilityEPSS 0.8%CVE-2025-32990MEDIUMGnutls: vulnerability in gnutls certtool template parsingEPSS 0.8%CVE-2023-38154HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-82717HIGHCNAME synthesis could lead to heap corruptionEPSS 0.8%CVE-2024-38170HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.8%CVE-2021-21948HIGHA heap-based buffer overflow vulnerability exists in the readDatHeadVec functionality of AnyCubic Chitubox AnyCubic Plugin 1.0.0. A speciallEPSS 0.8%CVE-2026-32623HIGHxrdp: Heap buffer overflow in NeutrinoRDP channel reassemblyEPSS 0.8%CVE-2026-66040HIGHFFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf EncoderEPSS 0.8%CVE-2025-50168HIGHWin32k Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-49673HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2025-49669HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2025-49668HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2025-49753HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-54626CRITICALSAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch)EPSS 0.8%CVE-2026-54627CRITICALSAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)EPSS 0.8%CVE-2025-49663HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2025-67268CRITICALgpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 funEPSS 0.8%CVE-2025-0755HIGHMongoDB C Driver bson library may be susceptible to buffer overflowEPSS 0.8%CVE-2024-7973HIGHHeap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of bounds memory read viaEPSS 0.8%CVE-2024-49030HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.8%