Falhas do tipo CWE-122

3.190 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2025-34164CRITICALNetSupport Manager < 14.12.0000 Heap-Based Buffer OverflowEPSS 0.7%CVE-2026-51219HIGHA heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.3.3 to v2.3.6 allows attackers to cause EPSS 0.7%CVE-2026-12844HIGHList::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise functionEPSS 0.7%CVE-2023-23378HIGHPrint 3D Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-62458HIGHWin32k Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2023-23390HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-14425HIGHGIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.7%CVE-2024-56732CRITICALHarfBuzz heap-buffer-overflow on hb_cairo_glyphs_from_bufferEPSS 0.7%CVE-2026-5402HIGHHeap-based Buffer Overflow in WiresharkEPSS 0.7%CVE-2025-47169HIGHMicrosoft Word Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-57637HIGHBuffer overflow vulnerability in D-Link DI-7100G 2020-02-21 in the sub_451754 function of the jhttpd service in the viav4 parameter allowingEPSS 0.7%CVE-2023-23377HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-49600HIGHAn out-of-bounds write vulnerability exists in the PlyFile ply_cast_ascii functionality of libigl v2.5.0. A specially crafted .ply file can EPSS 0.7%CVE-2022-26061HIGHA heap-based buffer overflow vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file canEPSS 0.6%CVE-2025-21375HIGHKernel Streaming WOW Thunk Service Driver Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2025-40907MEDIUMFCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) libraryEPSS 0.6%CVE-2021-3903HIGHHeap-based Buffer Overflow in vim/vimEPSS 0.6%CVE-2026-64830HIGHFFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle DemuxerEPSS 0.6%CVE-2026-25646HIGHLIBPNG has a heap buffer overflow in png_set_quantizeEPSS 0.6%CVE-2023-27911HIGHA user may be tricked into opening a malicious FBX file that may exploit a heap buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or EPSS 0.6%