Falhas do tipo CWE-122

3.190 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2026-65796HIGHWindows iSCSI Target Service Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-71331HIGHWindows Device Health Attestation (DHA) Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-69786HIGHWindows Text Shaping Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-36770HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.7%CVE-2024-34249CRITICALwasm3 v0.5.0 was discovered to contain a heap buffer overflow which leads to segmentation fault via the function "DeallocateSlot" in wasm3/sEPSS 0.7%CVE-2026-75143CRITICALFFmpeg Heap Buffer Overflow via RIST Protocol ReaderEPSS 0.7%CVE-2024-40764HIGHHeap-based buffer overflow vulnerability in the SonicOS IPSec VPN allows an unauthenticated remote attacker to cause Denial of Service (DoS)EPSS 0.7%CVE-2025-24066HIGHKernel Streaming Service Driver Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2022-0943HIGHHeap-based Buffer Overflow occurs in vim in vim/vimEPSS 0.7%CVE-2026-57156HIGHFreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsingEPSS 0.7%CVE-2025-24067HIGHKernel Streaming Service Driver Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2023-21738HIGHMicrosoft Office Visio Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-20837HIGHWindows Media Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-7040HIGHText::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have heap overflow when processing some malformed UTF-8 charactersEPSS 0.7%CVE-2023-38170HIGHHEVC Video Extensions Remote Code Execution VulnerabilityEPSS 0.7%CVE-2022-43171MEDIUMA heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind function of LIEF v0.12.1 allows attackers to cause a DeEPSS 0.7%CVE-2025-24063HIGHKernel Streaming Service Driver Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-92399MEDIUMGPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflowEPSS 0.7%CVE-2026-93962MEDIUMKamailio CDP Diameter Receiver receiver.c shm_malloc heap-based overflowEPSS 0.7%CVE-2026-4391MEDIUMTeamSpeak 3 Server ECC Key heap-based overflowEPSS 0.7%