CWE-122 堆缓冲区溢出 类弱点 2701 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-122 堆缓冲区溢出属于内存安全漏洞，指写入数据超出在堆内存（如通过 malloc 分配）中分配的缓冲区边界。攻击者利用此漏洞可覆盖相邻内存数据，导致程序崩溃或执行任意代码，从而获取系统控制权。开发者应避免此类风险，需严格验证输入长度，确保写入操作不超出缓冲区上限，并使用现代安全语言或库来自动管理内存边界。
#define BUFSIZE 256 int main(int argc, char **argv) { char *buf; buf = (char *)malloc(sizeof(char)*BUFSIZE); strcpy(buf, argv[1]); }char * copy_input(char *user_supplied_string){ int i, dst_index; char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE); if ( MAX_SIZE <= strlen(user_supplied_string) ){ die("user string too long, die evil hacker!"); } dst_index = 0; for ( i = 0; i < strlen(user_supplied_string); i++ ){ if( '&' == user_supplied_string[i] ){ dst_buf[dst_index++] = '&'; dst_buf[dst_index++] = 'a'; dst_buf[dst_index++] = 'm'; dst_buf[dst_index++] = 'p'; dst_buf[dst_index++] = ';'; } else if ('<' == user_supplied_string[i] ){ /* encode to < */ } else dst_buf[dst_index++] = user_supplied_string[i]; } return ds| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-21812 | Microsoft Windows Common Log File System Driver 安全漏洞 — Windows 10 Version 1507 | 7.8 | High | 2023-02-14 |
| CVE-2023-21804 | Microsoft Graphics Component 安全漏洞 — Windows 10 Version 1507 | 7.8 | High | 2023-02-14 |
| CVE-2023-21799 | Microsoft WDAC OLE DB provider for SQL 安全漏洞 — Windows 10 Version 1507 | 8.8 | High | 2023-02-14 |
| CVE-2023-23378 | Microsoft 3D Builder 安全漏洞 — Print 3D | 7.8 | High | 2023-02-14 |
| CVE-2023-21528 | Microsoft SQL Server 安全漏洞 — Microsoft SQL Server 2008 R2 Service Pack 3 (QFE) | 7.8 | High | 2023-02-14 |
| CVE-2023-24551 | Siemens Solid Edge 安全漏洞 — Solid Edge SE2022 | 7.8 | High | 2023-02-14 |
| CVE-2023-24550 | Siemens Solid Edge 安全漏洞 — Solid Edge SE2022 | 7.8 | High | 2023-02-14 |
| CVE-2023-0819 | GPAC 缓冲区错误漏洞 — gpac/gpac | 7.8 | - | 2023-02-13 |
| CVE-2022-34454 | Dell PowerScale OneFS 缓冲区错误漏洞 — PowerScale OneFS | 6.7 | Medium | 2023-02-10 |
| CVE-2023-0760 | GPAC 缓冲区错误漏洞 — gpac/gpac | 7.8 | - | 2023-02-09 |
| CVE-2022-34400 | Dell BIOS 缓冲区错误漏洞 — CPG BIOS | 7.1 | High | 2023-02-01 |
| CVE-2023-23582 | Snap One Wattbox 缓冲区错误漏洞 — Wattbox WB-300-IP-3 | 5.3 | Medium | 2023-01-30 |
| CVE-2022-41991 | Siretta QUARTZ-GOLD 缓冲区错误漏洞 — QUARTZ-GOLD | 9.8 | - | 2023-01-26 |
| CVE-2022-42403 | PDF-XChange Editor 缓冲区错误漏洞 — PDF-XChange Editor | 7.8 | - | 2023-01-26 |
| CVE-2022-42405 | PDF-XChange Editor 缓冲区错误漏洞 — PDF-XChange Editor | 7.8 | - | 2023-01-26 |
| CVE-2022-1892 | Lenovo Notebook 安全漏洞 — BIOS | 6.7 | Medium | 2023-01-23 |
| CVE-2022-1891 | Lenovo Notebook 安全漏洞 — BIOS | 6.7 | Medium | 2023-01-23 |
| CVE-2022-1890 | Lenovo Notebook 缓冲区错误漏洞 — BIOS | 6.7 | Medium | 2023-01-23 |
| CVE-2023-0433 | Vim 安全漏洞 — vim/vim | 7.8 | - | 2023-01-21 |
| CVE-2023-21605 | Adobe Acrobat Reader 安全漏洞 — Acrobat Reader | 7.8 | High | 2023-01-18 |
| CVE-2022-3160 | Siemens Teamcenter Visualization 和 JT2Go 缓冲区错误漏洞 — JT2Go | 7.8 | High | 2023-01-13 |
| CVE-2023-0288 | vim 安全漏洞 — vim/vim | 7.8 | - | 2023-01-13 |
| CVE-2023-21587 | Adobe InDesign 安全漏洞 — InDesign | 7.8 | High | 2023-01-13 |
| CVE-2023-21594 | Adobe InCopy 安全漏洞 — InCopy | 7.8 | High | 2023-01-13 |
| CVE-2022-43591 | Qt 安全漏洞 — Qt | 8.8 | - | 2023-01-12 |
| CVE-2022-3437 | Heimdal GSSAPI 安全漏洞 — samba | 6.5 | - | 2023-01-12 |
| CVE-2021-3966 | Zephyr 安全漏洞 — zephyr | 9.6 | Critical | 2023-01-11 |
| CVE-2023-21793 | Microsoft 3D Builder 安全漏洞 — 3D Builder | 7.8 | High | 2023-01-10 |
| CVE-2023-21792 | Microsoft 3D Builder 安全漏洞 — 3D Builder | 7.8 | High | 2023-01-10 |
| CVE-2023-21791 | Microsoft 3D Builder 安全漏洞 — 3D Builder | 7.8 | High | 2023-01-10 |
CWE-122（堆缓冲区溢出） 是常见的弱点类别，本平台收录该类弱点关联的 2701 条 CVE 漏洞。