Falhas do tipo CWE-122

3.734 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2025-30388HIGHWindows Graphics Component Remote Code Execution VulnerabilityEPSS 4.4%CVE-2024-20755HIGHAdobe Bridge PDF Parsing Heap Memory Corruption Remote Code Execution VulnerabilityEPSS 4.4%CVE-2021-36056MEDIUMXMP Toolkit SDK Heap-based Buffer Overflow Could Lead To Arbitrary Code ExecutionEPSS 4.4%CVE-2024-29204CRITICALA Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to eEPSS 4.3%CVE-2026-85103CRITICALHeap-based Buffer Overflow in VPN Certificate ASN.1 DecodingEPSS 4.3%CVE-2019-15693—TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vEPSS 4.3%CVE-2024-30091HIGHWin32k Elevation of Privilege VulnerabilityEPSS 4.3%CVE-2023-36400HIGHWindows HMAC Key Derivation Elevation of Privilege VulnerabilityEPSS 4.3%CVE-2021-39823HIGHsvg-native-viewer Heap Buffer overflow VulnerabilityEPSS 4.2%CVE-2024-26211HIGHWindows Remote Access Connection Manager Elevation of Privilege VulnerabilityEPSS 4.1%CVE-2022-31003CRITICALHeap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIPEPSS 4.1%CVE-2014-9495HIGHHeap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, EPSS 4.1%CVE-2026-25243HIGHredis-server RESTORE invalid memory access may allow remote code executionEPSS 4.0%CVE-2020-1711HIGHAn out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a responseEPSS 4.0%CVE-2018-1089HIGH389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possiblyEPSS 4.0%CVE-2022-39260HIGHGit vulnerable to Remote Code Execution via Heap overflow in `git shell`EPSS 4.0%CVE-2021-31454HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interactioEPSS 4.0%CVE-2022-24096HIGHAdobe After Effects Heap-based Buffer Overflow Arbitrary code executionEPSS 3.9%CVE-2020-25187HIGHMedtronic MyCareLink Smart Heap-based Buffer OverflowEPSS 3.9%CVE-2018-14813—Fuji Electric V-Server 4.0.3.0 and prior, A heap-based buffer overflow vulnerability has been identified, which may allow remote code executEPSS 3.9%