Falhas do tipo CWE-122

3.190 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2023-39946HIGHHeap overflow in push_back_helper due to a CDR messageEPSS 0.9%CVE-2026-25173HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-30075HIGHWindows Link Layer Topology Discovery Protocol Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-15422CRITICALSCTP needs to better-check INIT ACK chunk parametersEPSS 0.9%CVE-2024-38152HIGHWindows OLE Remote Code Execution VulnerabilityEPSS 0.9%CVE-2025-58447CRITICALrAthena has heap-based buffer overflow in login serverEPSS 0.9%CVE-2026-69491CRITICALMicrosoft DirectMusic Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-23384HIGHMicrosoft SQL Server Remote Code Execution VulnerabilityEPSS 0.9%CVE-2019-14814MEDIUMThere is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, thaEPSS 0.9%CVE-2024-32664MEDIUMSuricata's base64 contains an out of bounds writeEPSS 0.9%CVE-2024-30259HIGHFastDDS heap buffer overflow when publisher sends malformed packetEPSS 0.9%CVE-2026-69623HIGHWindows HTTP Print Provider Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-29161HIGHHDF5 through 1.14.3 contains a heap buffer overflow in H5A__attr_release_table, resulting in the corruption of the instruction pointer and cEPSS 0.9%CVE-2024-38261HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-32710HIGHHeap-based Buffer Overflow in MariaDBEPSS 0.9%CVE-2024-37041MEDIUMQTS, QuTS heroEPSS 0.9%CVE-2025-49670MEDIUMWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-45584HIGHMicrosoft Defender Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-69729HIGHWindows Credential Providers Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-78456HIGHSQL Server Remote Code Execution VulnerabilityEPSS 0.9%