Falhas do tipo CWE-122

3.195 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2023-1448MEDIUMGPAC mpegts.c gf_m2ts_process_sdt heap-based overflowEPSS 0.4%CVE-2023-38080HIGHKofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-24335HIGHA heap buffer overflow occurs in the dfs_v2 romfs filesystem RT-Thread through 5.0.2.EPSS 0.4%CVE-2024-24334HIGHA heap buffer overflow occurs in dfs_v2 dfs_file in RT-Thread through 5.0.2.EPSS 0.4%CVE-2026-48131HIGHVPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number ZeroEPSS 0.4%CVE-2025-59482HIGHHeap-based Buffer Overflow Vulnerability in TP-Link Archer AX53EPSS 0.4%CVE-2025-58455HIGHHeap-based Buffer Overflow Vulnerability in TP-Link Archer AX53EPSS 0.4%CVE-2025-59487HIGHHeap-based Buffer Overflow Vulnerability in TP-Link Archer AX53EPSS 0.4%CVE-2025-58077HIGHHeap-based Buffer Overflow Vulnerability in TP-Link Archer AX53EPSS 0.4%CVE-2025-61944HIGHHeap-based Buffer Overflow Vulnerability in TP-Link Archer AX53EPSS 0.4%CVE-2024-23154HIGHMultiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsEPSS 0.4%CVE-2026-59187HIGHOpenEXR: exrmetrics deep pixelmode heap buffer overflowEPSS 0.4%CVE-2022-39068MEDIUMBuffer Overflow Vulnerability in ZTE MF296REPSS 0.4%CVE-2026-48135MEDIUMHTTP service can incorrectly process malformed HTTP requestsEPSS 0.4%CVE-2025-2308MEDIUMHDF5 Scale-Offset Filter H5Z__scaleoffset_decompress_one_byte heap-based overflowEPSS 0.4%CVE-2024-37001HIGHMultiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareEPSS 0.4%CVE-2026-3931HIGHHeap buffer overflow in Skia in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a EPSS 0.4%CVE-2026-68580HIGHFreeRDP before 3.29.0 Integer Overflow via Audio Input ChannelEPSS 0.4%CVE-2026-14385HIGHHeap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to perform out of bounds memory accesEPSS 0.4%CVE-2025-57106HIGHKitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the BEPSS 0.4%