Falhas do tipo CWE-122

3.190 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2024-2824MEDIUMMatthias-Wandel jhead exif.c PrintFormatNumber heap-based overflowEPSS 0.7%CVE-2024-43626HIGHWindows Telephony Service Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2022-38411HIGHAdobe Animate SVG File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.7%CVE-2024-56737HIGHGNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem.EPSS 0.7%CVE-2023-26793CRITICALlibmodbus v3.1.10 has a heap-based buffer overflow vulnerability in read_io_status function in src/modbus.c.EPSS 0.7%CVE-2026-30999HIGHA heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a craftEPSS 0.7%CVE-2025-49744HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-72970HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-45591HIGHA CWE-122 “Heap-based Buffer Overflow” vulnerability in the “logger_generic” function of the “Ax_rtu” binary allows a remote authenticated aEPSS 0.7%CVE-2025-2592MEDIUMOpen Asset Import Library Assimp CSMLoader.cpp InternReadFile heap-based overflowEPSS 0.7%CVE-2026-67873CRITICALA heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegmEPSS 0.7%CVE-2025-66217HIGHAIS-catcher Integer Underflow in MQTT Packet Parsing leading to Heap Buffer OverflowEPSS 0.7%CVE-2021-25360CRITICALAn improper input validation vulnerability in libswmfextractor library prior to SMR APR-2021 Release 1 allows attackers to execute arbitraryEPSS 0.7%CVE-2023-5404HIGHServer receiving a malformed message can cause a pointer to be overwritten which can result in a remote code execution or failure. See HoneyEPSS 0.7%CVE-2026-69325HIGHMicrosoft JScript Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-21737HIGHMicrosoft Office Visio Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-32026HIGHMicrosoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-32028HIGHMicrosoft SQL OLE DB Remote Code Execution VulnerabilityEPSS 0.7%CVE-2024-6873HIGHSpecially crafted request could caused undefined behaviour which may lead to Remote Code Execution.EPSS 0.7%CVE-2025-21356HIGHMicrosoft Office Visio Remote Code Execution VulnerabilityEPSS 0.7%