Falhas do tipo CWE-122

3.737 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2023-35302HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-38212HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-7055MEDIUMFFmpeg pnmdec.c pnm_decode_frame heap-based overflowEPSS 1.4%CVE-2022-2284HIGHHeap-based Buffer Overflow in vim/vimEPSS 1.4%CVE-2024-43517HIGHMicrosoft ActiveX Data Objects Remote Code Execution VulnerabilityEPSS 1.4%CVE-2025-21306HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.4%CVE-2025-21302HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.4%CVE-2025-21303HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.4%CVE-2025-21252HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.4%CVE-2025-21305HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-38045HIGHWindows TCP/IP Remote Code Execution VulnerabilityEPSS 1.4%CVE-2019-10982—Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by EPSS 1.4%CVE-2019-13536—Delta Electronics TPEditor, Versions 1.94 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specEPSS 1.4%CVE-2025-29966HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 1.4%CVE-2022-32137HIGHCODESYS Runtime System prone to heap based buffer overflowEPSS 1.4%CVE-2026-42512HIGHRemotely triggerable out-of-bounds heap write in dhclientEPSS 1.4%CVE-2018-1056LOWAn out-of-bounds heap buffer read flaw was found in the way advancecomp before 2.1-2018/02 handled processing of ZIP files. An attacker coulEPSS 1.4%CVE-2024-21886HIGHXorg-x11-server: heap buffer overflow in disabledeviceEPSS 1.4%CVE-2024-21885HIGHXorg-x11-server: heap buffer overflow in xisenddevicehierarchyeventEPSS 1.4%CVE-2021-31485HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%