Falhas do tipo CWE-122

3.190 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2024-38065MEDIUMSecure Boot Security Feature Bypass VulnerabilityEPSS 0.9%CVE-2023-32138HIGHD-Link DAP-1360 webproc Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.9%CVE-2025-21180HIGHWindows exFAT File System Remote Code Execution VulnerabilityEPSS 0.9%CVE-2025-53853CRITICALA heap-based buffer overflow vulnerability exists in the ISHNE parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchEPSS 0.9%CVE-2023-32047HIGHPaint 3D Remote Code Execution VulnerabilityEPSS 0.9%CVE-2025-53511CRITICALA heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch EPSS 0.9%CVE-2023-21791HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-21785HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-21790HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-63090HIGHProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet ReassemblyEPSS 0.9%CVE-2026-69276CRITICALMicrosoft UxTheme Library (uxtheme.dll) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-21793HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-69431CRITICALTelnet Client Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-21786HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-21787HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-21781HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-32621CRITICALHDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5HG_read in H5HG.c (called from H5VL__native_blob_get in H5VLnative_blEPSS 0.9%CVE-2020-7852HIGHDaviewIndy Heap Overflow VulnerabilitiesEPSS 0.9%CVE-2022-43648HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 1.20B03 routers.EPSS 0.9%CVE-2022-20946HIGHA vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of Cisco Firepower Threat Defense (FTD) Software couEPSS 0.9%