内存破坏

浏览器、内核、解析器和固件里的经典问题，绝大多数靠模糊测试发现。

影响

导致进程崩溃，或在精心构造的条件下实现任意代码执行

观察点

AddressSanitizer 报告越界访问或释放后使用

修复

修复边界检查，开启编译器加固选项，并逐步迁移到内存安全语言。

弱点分布

• 内存破坏（通用）320
• 释放后使用90
• Unlabeled87
• 缓冲区越界读67
• 经典缓冲区溢出59
• 堆溢出55
• 越界读49
• 空指针解引用42
• 栈溢出35
• 整数溢出28
• 双重释放17
• Array Index Underflow16
• Improper Null Termination11
• 类型混淆9
• Incorrect Calculation of Buffer Size8
• Buffer Underflow7
• Off-by-one Error6
• Integer Underflow5
• Buffer Under-read4
• Write-what-where Condition3
• Free of Memory not on the Heap1
• Integer Overflow to Buffer Overflow1
• Missing Release of Memory after Effective Lifetime1
• Reachable Assertion1
• 违反安全设计原则（按标题归类）1
• Wrap-around Error1

共现类别

暂无共现数据。

高票报告

当前状态 695 份 · 全部 924 · 筛选赏金 $426,608

1. 1,289
   RCE on Steam Client via buffer overflow in Server InfoValve · 2019-03-16 · 严重
   $0经典缓冲区溢出
2. 741
   Use-After-Free In IPV6_2292PKTOPTIONS leading To Arbitrary Kernel R/W PrimitivesPlayStation · 2020-07-07 · 高危
   $10,000释放后使用
3. 321
   Malformed .BMP file in Counter-Strike 1.6 may cause shellcode injectionValve · 2020-02-28 · 高危
   $0经典缓冲区溢出
4. 309
   Heap overflow happen when receiving short length key from ssh server using ssh protocol 1PuTTY (European Commission - DIGIT) · 2019-09-20 · 高危
   $3,646堆溢出
5. 298
   SOCK_RAW sockets reachable from Webkit process allows triggering double free in IP6_EXTHDR_CHECKPlayStation · 2021-01-13 · 高危
   $10,000双重释放
6. 280
   size_t-to-int vulnerability in exFAT leads to memory corruption via malformed USB flash drivesPlayStation · 2022-09-22 · 高危
   $10,000Incorrect Calculation of Buffer Size
7. 268
   Malformed NAV file leads to buffer overflow and code execution in Left4Dead2.exeValve · 2020-03-26 · 严重
   $10,000经典缓冲区溢出
8. 236
   sys_fsc2h_ctrl kernel stack freePlayStation · 2025-04-18 · 高危
   $10,000释放后使用
9. 229
   Unchecked weapon id in WeaponList message parser on client leads to RCEValve · 2019-09-18 · 严重
   $3,000Array Index Underflow
10. 228
    Double fdrop on a socket through sys_netcontrolPlayStation · 2026-05-01 · 高危
    $10,000双重释放
11. 228
    HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organizationHackerOne · 2024-02-04 · 高危
    $0Improper Null Termination
12. 219
    OOB reads in network message handlers leads to RCEValve · 2021-05-04 · 严重
    $7,500越界读
13. 209
    RCE on CS:GO client using unsanitized entity ID in EntityMsg messageValve · 2021-05-28 · 严重
    $9,000越界读
14. 197
    Remote vulnerabilities in sppPlayStation · 2024-04-26 · 高危
    $12,500经典缓冲区溢出
15. 196
    Buffer overrun in Steam SILK voice decoderValve · 2021-09-14 · 严重
    $7,500经典缓冲区溢出
16. 173
    [Portal 2] Remote Code Execution via voice packetsValve · 2021-05-11 · 严重
    $5,000经典缓冲区溢出
17. 163
    [Half-Life 1] Malformed map name leads to memory corruption and code executionValve · 2020-09-23 · 高危
    $1,500经典缓冲区溢出
18. 154
    Malformed .BSP Access Violation in CS:GO can lead to Remote Code ExecutionValve · 2018-07-20 · 严重
    $0经典缓冲区溢出
19. 143
    Use-after-free in setsockopt IPV6_2292PKTOPTIONS (CVE-2020-7457)PlayStation · 2022-09-21 · 高危
    $10,000释放后使用
20. 142
    Subdomain Takeover Via Insecure CloudFront Distribution cdn.grab.comGrab · 2021-02-24 · 中危
    $1,000Array Index Underflow
21. 125
    Race Conditions in Popular reports feature.HackerOne · 2016-08-03 · 未评级
    $0内存破坏（通用）
22. 116
    Null Pointer Dereference by Crafted Response from AI ModelBrave Software · 2025-03-26 · 低危
    $0空指针解引用
23. 109
    Specially Crafted Closed Captions File can lead to Remote Code Execution in CS:GO and other Source GamesValve · 2021-05-05 · 严重
    $7,500经典缓冲区溢出
24. 106
    Access Violation Reading in libfaad_pluginVLC (European Commission - DIGIT) · 2019-07-24 · 中危
    $1,121Integer Underflow
25. 99
    Stack overflow in XML ParsingNotepad++ · 2019-08-25 · 高危
    $0栈溢出