Falhas do tipo CWE-122

3.735 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2024-28913HIGHMicrosoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityEPSS 2.3%CVE-2025-62454HIGHWindows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityEPSS 2.3%CVE-2023-50229HIGHBlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 2.3%CVE-2019-5048HIGHA specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory manipulation, this caEPSS 2.3%CVE-2019-5045HIGHA specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.52EPSS 2.3%CVE-2019-5046HIGHA specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.52EPSS 2.3%CVE-2023-0666MEDIUMWireshark RTPS Parsing Buffer OverflowEPSS 2.3%CVE-2021-21825HIGHA heap-based buffer overflow vulnerability exists in the XML Decompression PlainTextUncompressor::UncompressItem functionality of AT&T Labs’EPSS 2.3%CVE-2021-21830HIGHA heap-based buffer overflow vulnerability exists in the XML Decompression LabelDict::Load functionality of AT&T Labs’ Xmill 0.7. A speciallEPSS 2.3%CVE-2024-28926HIGHMicrosoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityEPSS 2.3%CVE-2024-28912HIGHMicrosoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityEPSS 2.3%CVE-2024-28941HIGHMicrosoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityEPSS 2.3%CVE-2021-3968HIGHHeap-based Buffer Overflow in vim/vimEPSS 2.3%CVE-2020-16223—Delta Electronics TPEditor Versions 1.97 and prior. A heap-based buffer overflow may be exploited by processing a specially crafted project EPSS 2.2%CVE-2023-52356HIGHLibtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of serviceEPSS 2.2%CVE-2024-26195HIGHDHCP Server Service Remote Code Execution VulnerabilityEPSS 2.2%CVE-2024-26202HIGHDHCP Server Service Remote Code Execution VulnerabilityEPSS 2.2%CVE-2025-24993HIGHWindows NTFS Remote Code Execution VulnerabilityEPSS 2.2%KEVCVE-2024-28915HIGHMicrosoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityEPSS 2.2%CVE-2024-28911HIGHMicrosoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityEPSS 2.2%