Base de CVEs

CVE-2026-49841 Crítica · 9.8 CWE-122 09/06/2026

FreeSWITCH: estouro de buffer no heap antes da autenticação no tratamento de POST HTTP do mod_verto

FreeSWITCH é uma Software Defined Telecom Stack que permite a transformação digital de switches de telecomunicações proprietários para uma implementação em software que roda em qualquer hardware comum. Antes da versão 1.11.1, o manipulador de requisições HTTP do mod_verto aloca um buffer fixo de 2 MiB para um corpo POST application/x-www-form-urlencoded, mas aceita Content-Length de até pouco menos de 10 MiB. O laço de leitura do corpo é limitado pelo Content-Length e não pelo tamanho do buffer, produzindo um estouro de heap controlado pelo atacante de até ~8 MiB — antes de a verificação de autenticação basic HTTP ser executada. Este problema foi corrigido na versão 1.11.1.

CVE-2026-48574 Alta · 7.8 CWE-122 09/06/2026

Windows Media Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.

CVE-2026-47652 Alta · 8.2 CWE-122 09/06/2026

Windows Hyper-V Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.

CVE-2026-47635 Alta · 8.4 CWE-122 09/06/2026

Microsoft Outlook and Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-47291 Crítica · 9.8 CWE-122 09/06/2026

Execução remota de código no HTTP.sys do Microsoft Windows

Estouro de inteiro (integer overflow) ou wraparound no Windows HTTP.sys permite que um atacante não autorizado execute código por meio da rede.

CVE-2026-47289 Alta · 8.8 CWE-122 09/06/2026

Remote Desktop Client Remote Code Execution Vulnerability

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

CVE-2026-45657 Crítica · 9.8 CWE-122 09/06/2026

Execução Remota de Código por Use-After-Free no Kernel do Microsoft Windows (CVE-2026-45657)

Uso após liberação (use after free) no Kernel do Windows permite que um atacante não autorizado execute código pela rede.

CVE-2026-45638 Alta · 7.8 CWE-122 09/06/2026

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-45475 Alta · 7.8 CWE-122 09/06/2026

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-45469 Alta · 7.8 CWE-122 09/06/2026

Microsoft Excel Remote Code Execution Vulnerability

Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVE-2026-45466 Baixa · 3.3 CWE-122 09/06/2026

Microsoft Word Information Disclosure Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVE-2026-44824 Alta · 7.8 CWE-122 09/06/2026

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-44819 Alta · 7.8 CWE-122 09/06/2026

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-44814 Média · 5.5 CWE-122 09/06/2026

Windows DWM Core Library Information Disclosure Vulnerability

Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.

CVE-2026-44799 Alta · 7.5 CWE-122 09/06/2026

Remote Desktop Client Remote Code Execution Vulnerability

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

CVE-2026-42993 Alta · 7.5 CWE-122 09/06/2026

Remote Desktop Client Remote Code Execution Vulnerability

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

CVE-2026-42992 Alta · 7.5 CWE-122 09/06/2026

Remote Desktop Client Remote Code Execution Vulnerability

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

CVE-2026-42980 Alta · 7.8 CWE-122 09/06/2026

NT OS Kernel Elevation of Privilege Vulnerability

Integer underflow (wrap or wraparound) in Windows NT OS Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-42904 Crítica · 9.6 CWE-122 09/06/2026

Windows TCP/IP Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to elevate privileges over an adjacent network.

CVE-2026-41108 Alta · 7.0 CWE-122 09/06/2026

Windows DNS Client Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.

CVE-2026-40404 Alta · 7.8 CWE-122 09/06/2026

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

CVE-2026-24180 Alta · 7.3 CWE-122 09/06/2026

Heap-based Buffer Overflow em NVIDIA Data Loading Library

NVIDIA DALI contains a vulnerability in a component where an attacker could cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

CVE-2026-11792 Baixa · 3.3 CWE-122 09/06/2026

389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string)

A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the create_masked_entry_string() function in auditlog.c copies a fixed-length password mask into a precisely-sized heap buffer without checking available space. If a short cleartext password is logged (requiring non-default CLEAR password storage or a compromised replication peer), the copy overflows the buffer, corrupting heap memory and audit log output.

CVE-2026-41981 Média · 5.3 CWE-122 09/06/2026

Heap-based Buffer Overflow em Huawei Harmonyos

Out-of-bounds write vulnerability in the IPC module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2026-42536 Alta · 7.5 CWE-122 08/06/2026

Apache HTTP Server: mod_xml2enc heap overflow

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.