Falhas do tipo CWE-122

3.191 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2026-4152HIGHGIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-4177CRITICALYAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitterEPSS 0.6%CVE-2023-4738HIGHHeap-based Buffer Overflow in vim/vimEPSS 0.6%CVE-2026-91964HIGHFreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingTokenEPSS 0.6%CVE-2026-32961MEDIUMSD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in packet data processing of EPSS 0.6%CVE-2023-28292HIGHRaw Image Extension Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-41509MEDIUMInteger underflow in crypto_sign_open() leads to buffer overflowEPSS 0.6%CVE-2025-49730HIGHMicrosoft Windows QoS Scheduler Driver Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-26327MEDIUMAn issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFEPSS 0.6%CVE-2025-27490HIGHWindows Bluetooth Service Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2025-49729HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-1426HIGHHeap buffer overflow in GPU in Google Chrome on Android prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corrupEPSS 0.6%CVE-2023-1906MEDIUMA heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An EPSS 0.6%CVE-2026-5264HIGHDTLS 1.3 ACK heap buffer overflowEPSS 0.6%CVE-2026-4395LOWHeap-based buffer overflow in wc_ecc_import_x963_ex KCAPI pathEPSS 0.6%CVE-2026-25794HIGHImageMagick has heap-buffer-overflow via signed integer overflow in `WriteUHDRImage` when writing UHDR images with large dimensionsEPSS 0.6%CVE-2025-2337MEDIUMtbeu matio mat.c Mat_VarPrint heap-based overflowEPSS 0.6%CVE-2025-0903HIGHPDF-XChange Editor RTF File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-22891CRITICALA heap-based buffer overflow vulnerability exists in the Intan CLP parsing functionality of The Biosig Project libbiosig 3.9.2 and Master BrEPSS 0.6%CVE-2025-7208MEDIUM9fans plan9port x509.c edump heap-based overflowEPSS 0.6%