Falhas do tipo CWE-122

2.554 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2023-44442HIGHGIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 61.4%CVE-2024-10525HIGHEclipse Mosquito: Heap Buffer Overflow in my_subscribe_callbackEPSS 58.5%CVE-2024-38812CRITICALHeap-overflow vulnerabilityEPSS 54.6%KEVCVE-2020-24435HIGHAcrobat Reader DC Heap-based Buffer Overflow Could Lead to Arbitrary Code ExecutionEPSS 52.7%CVE-2019-5436HIGHA heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.EPSS 49.7%CVE-2023-28252HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 49.0%KEVCVE-2023-33133HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 44.0%CVE-2022-24834HIGHHeap overflow issue with the Lua cjson library used by RedisEPSS 41.4%CVE-2021-44708HIGHAdobe Acrobat Pro DC Heap Overflow could lead to Arbitrary code executionEPSS 39.3%CVE-2019-3568CRITICALA buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a EPSS 39.2%KEVCVE-2023-28231HIGHDHCP Server Service Remote Code Execution VulnerabilityEPSS 36.9%CVE-2022-35712CRITICALAdobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 36.8%CVE-2017-13090HIGHGNU Wget: heap overflow in HTTP protocol handlingEPSS 36.6%CVE-2024-24996CRITICALA Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to eEPSS 32.2%CVE-2021-44709HIGHAdobe Acrobat Pro DC Heap Overflow Vulnerability could lead to Arbitrary code executionEPSS 30.0%CVE-2024-4323CRITICALFluent Bit Memory Corruption VulnerabilityEPSS 28.3%CVE-2025-40597HIGHA Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of SerEPSS 27.6%CVE-2023-21690CRITICALMicrosoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution VulnerabilityEPSS 27.5%CVE-2023-44441HIGHGIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 27.3%CVE-2022-0572HIGHHeap-based Buffer Overflow in vim/vimEPSS 26.6%