Falhas do tipo CWE-122

3.190 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2019-16778LOWHeap buffer overflow in `UnsortedSegmentSum` in TensorFlowEPSS 0.8%CVE-2023-36042MEDIUMVisual Studio Denial of Service VulnerabilityEPSS 0.8%CVE-2025-32990MEDIUMGnutls: vulnerability in gnutls certtool template parsingEPSS 0.8%CVE-2023-38154HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-82717HIGHCNAME synthesis could lead to heap corruptionEPSS 0.8%CVE-2024-38170HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.8%CVE-2021-21948HIGHA heap-based buffer overflow vulnerability exists in the readDatHeadVec functionality of AnyCubic Chitubox AnyCubic Plugin 1.0.0. A speciallEPSS 0.8%CVE-2026-32623HIGHxrdp: Heap buffer overflow in NeutrinoRDP channel reassemblyEPSS 0.8%CVE-2025-50168HIGHWin32k Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-66040HIGHFFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf EncoderEPSS 0.8%CVE-2025-49673HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2025-49668HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-54626CRITICALSAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch)EPSS 0.8%CVE-2026-54627CRITICALSAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)EPSS 0.8%CVE-2025-49669HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2025-49753HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2025-49663HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2025-67268CRITICALgpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 funEPSS 0.8%CVE-2025-0755HIGHMongoDB C Driver bson library may be susceptible to buffer overflowEPSS 0.8%CVE-2024-7973HIGHHeap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of bounds memory read viaEPSS 0.8%