Falhas do tipo CWE-122

3.188 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2026-48131HIGHVPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number ZeroEPSS 2.7%CVE-2019-5154HIGHAn exploitable heap overflow vulnerability exists in the JPEG2000 parsing functionality of LEADTOOLS 20.0.2019.3.15. A specially crafted J2KEPSS 2.6%CVE-2026-48135MEDIUMHTTP service can incorrectly process malformed HTTP requestsEPSS 2.6%CVE-2025-30216CRITICALCryptoLib Has Heap Overflow in Crypto_TM_ProcessSecurity due to Unchecked Secondary Header LengthEPSS 2.6%CVE-2026-20820HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 2.6%CVE-2017-12704—A heap-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multipEPSS 2.6%CVE-2019-9502HIGHBroadcom wl driver is vulnerable to heap buffer overflowEPSS 2.6%CVE-2020-14482—Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior. Opening a specially crafted project file may overflow the heap, which mayEPSS 2.6%CVE-2020-6970—A Heap-based Buffer Overflow was found in Emerson OpenEnterprise SCADA Server 2.83 (if Modbus or ROC Interfaces have been installed and are EPSS 2.6%CVE-2023-21605HIGHAdobe Acrobat Reader DC Font Parsing Heap-based Buffer Overflow Arbitrary code executionEPSS 2.6%CVE-2019-5050HIGHA specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory manipulation, this caEPSS 2.6%CVE-2024-30038HIGHWin32k Elevation of Privilege VulnerabilityEPSS 2.6%CVE-2021-21829HIGHA heap-based buffer overflow vulnerability exists in the XML Decompression EnumerationUncompressor::UncompressItem functionality of AT&T LabEPSS 2.5%CVE-2022-1619MEDIUMHeap-based Buffer Overflow in function cmdline_erase_chars in vim/vimEPSS 2.5%CVE-2020-14524CRITICALSofting Industrial Automation OPCEPSS 2.5%CVE-2021-31454HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interactioEPSS 2.5%CVE-2019-18292—A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 ServEPSS 2.5%CVE-2019-18291—A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 ServEPSS 2.5%CVE-2019-18294—A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 ServEPSS 2.5%CVE-2019-18290—A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 ServEPSS 2.5%