Falhas do tipo CWE-122

3.190 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2022-2809HIGHUnauthenticated out of bounds heap write in bmcwebEPSS 0.6%CVE-2025-26666HIGHWindows Media Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-26674HIGHWindows Media Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-82820MEDIUMFLVMeta AMF String Processing amf.c amf_string_new heap-based overflowEPSS 0.6%CVE-2024-30066MEDIUMWinlogon Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-39825HIGHZoom Workplace Apps and Rooms Clients - Buffer OverflowEPSS 0.6%CVE-2024-6383MEDIUMMongoDB C Driver bson_string_append may be vulnerable to a buffer overflowEPSS 0.6%CVE-2026-4153HIGHGIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-2447HIGHHeap buffer overflow in libvpxEPSS 0.6%CVE-2024-6994HIGHHeap buffer overflow in Layout in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via EPSS 0.6%CVE-2024-48075MEDIUMA Heap buffer overflow in the server-site handshake implementation in Real Time Logic SharkSSL from 09/09/24 and earlier allows a remote attEPSS 0.6%CVE-2023-28269MEDIUMWindows Boot Manager Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2026-81477HIGHDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A high privileged attEPSS 0.6%CVE-2026-29004HIGHBusyBox DHCPv6 Client Heap Buffer Overflow via DNS_SERVERSEPSS 0.6%CVE-2025-15275HIGHFontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-15274HIGHFontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.6%CVE-2024-37280MEDIUMElasticsearch StackOverflow vulnerabilityEPSS 0.6%CVE-2025-15272HIGHFontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.6%CVE-2024-5160HIGHHeap buffer overflow in Dawn in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory write via EPSS 0.6%CVE-2026-56003HIGHlibXfont2 computeProps Property Buffer Heap Buffer OverflowEPSS 0.6%