Falhas do tipo CWE-122

3.195 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2026-5272HIGHHeap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML EPSS 0.4%CVE-2023-32157MEDIUMTesla Model 3 bsa_server BIP Heap-based Buffer Overflow Arbitrary Code Execution VulnerabilityEPSS 0.4%CVE-2023-28905HIGHHeap buffer overflow in picserverEPSS 0.4%CVE-2026-5275HIGHHeap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafEPSS 0.4%CVE-2023-42038HIGHKofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-73242HIGHFreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`EPSS 0.4%CVE-2025-32397HIGHAn Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the librEPSS 0.4%CVE-2023-38090HIGHKofax Power PDF popUpMenu Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-21676HIGHiccDEV has a Heap-based Buffer Overflow in its CIccMBB::Validate() functionEPSS 0.4%CVE-2023-35709HIGHAshlar-Vellum Cobalt Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-32400HIGHAn Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the librEPSS 0.4%CVE-2024-47417HIGHAnimate | Heap-based Buffer Overflow (CWE-122)EPSS 0.4%CVE-2025-2310MEDIUMHDF5 Metadata Attribute Decoder H5MM_strndup heap-based overflowEPSS 0.4%CVE-2023-34289HIGHAshlar-Vellum Cobalt Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-32396HIGHAn Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the librEPSS 0.4%CVE-2023-34299HIGHAshlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-3291MEDIUMHeap-based Buffer Overflow in gpac/gpacEPSS 0.4%CVE-2024-43756HIGHPhotoshop Desktop | Heap-based Buffer Overflow (CWE-122)EPSS 0.4%CVE-2026-79216HIGHBuffer overflow in Blink in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execuEPSS 0.4%CVE-2025-50617HIGHA buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046ed68 function of the cgitest.cgi file. AttackeEPSS 0.4%