Falhas do tipo CWE-122

3.190 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2026-53994HIGHProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size TruncationEPSS 0.7%CVE-2023-5400HIGHServer receiving a malformed message based on a using the specified key values can cause a heap overflow vulnerability which could lead to aEPSS 0.7%CVE-2019-15690HIGHLibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/EPSS 0.7%CVE-2026-34545HIGHOpenEXR: integer overflow lead to OOB in HTJ2K decoderEPSS 0.7%CVE-2025-32713HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-26011CRITICALCritical Heap Out-of-bounds Access in `pf_cluster_stats()` via Malicious /initialpose Covariance -- Potential Remote Code ExecutionEPSS 0.7%CVE-2026-79393HIGHA heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP CameraEPSS 0.7%CVE-2021-3835HIGHBuffer overflow in usb device classEPSS 0.7%CVE-2025-29911HIGHCryptoLib Has Heap Buffer Overflow in Crypto_AOS_ProcessSecurity FunctionEPSS 0.7%CVE-2026-14266HIGH7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-44418HIGHD-Link DIR-X3260 Prog.cgi Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-47868CRITICALApache NuttX RTOS: tools/bdf-converter.: tools/bdf-converter: Fix loop termination condition.EPSS 0.7%CVE-2026-33901HIGHImageMagick has a Heap Buffer Overflow via MVG decoderEPSS 0.7%CVE-2024-39883HIGHHeap-based Buffer Overflow in Delta Electronics CNCSoft-G2EPSS 0.7%CVE-2025-54462CRITICALA heap-based buffer overflow vulnerability exists in the Nex parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (EPSS 0.7%CVE-2025-53557CRITICALA heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch EPSS 0.7%CVE-2025-48005CRITICALA heap-based buffer overflow vulnerability exists in the RHS2000 parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranEPSS 0.7%CVE-2022-1240HIGHHeap buffer overflow in libr/bin/format/mach0/mach0.c in radareorg/radare2EPSS 0.7%CVE-2026-44050CRITICALHeap buffer overflow in CNID daemon comm_rcv()EPSS 0.7%CVE-2021-3770HIGHHeap-based Buffer Overflow in vim/vimEPSS 0.7%