Weakness (CWE)
CWE-122: Heap-based Buffer Overflow
The product writes past the end of a buffer that was allocated on the heap.
How to prevent it (7 mitigations)
-
Pre-design: Use a language or compiler that performs automatic bounds checking.
-
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
-
Operation, Build and Compilation
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
-
Operation, Build and Compilation
Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
-
Implementation
Implement and perform bounds checking on input.
-
Implementation
Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
-
Operation
Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth.
Source: MITRE CWE-122
2,892 results · Clear filters · Feed
-
High 8.8
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.
-
High 7.8
Windows NTFS Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft Local Security Authority Server (lsasrv) Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to execute code over a network.
-
High 8.8
Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Kerberos Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Device Association Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows HTTP.sys Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-62735 Public exploit
Windows HTTP.sys Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows HTTP.sys Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Brokering File System Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Brokering File System allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Message Queuing Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Win32k Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows MIDI Service Module Elevation of Privileges Vulnerability
Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Storage Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows DWM Core Library Elevation of Privilege Vulnerability
Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Remote Desktop Services Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows HTTP.sys Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Display Enhancement Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Telephony Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
-
High 7.5
Remote Desktop Client Remote Code Execution Vulnerability
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
-
High 7.8CVE-2026-54984 Public exploit
Windows Imaging Component Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.
-
High 7.0
Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.
-
High 8.1
ColdFusion | Heap-based Buffer Overflow (CWE-122)
ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require use…
-
High 8.5CVE-2026-73072 Public exploit
Vim: Heap Buffer Overflow when Loading a Spell File
Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes und…
-
High 7.1
net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords (128 bytes) when the device advertises the mcia_32dwords capability, but struct mlx5…
-
High 7.1
The nothings stb TrueType library contains a heap buffer overflow vulnerability
A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library wh…
-
High 7.5
Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to insta…
-
High 8.3
Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compr…
-
High 7.8
llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp
llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max parameter without overflow validation, causing …
-
High 7.5
Apache Portable Runtime Utility: Heap buffer overflow in APR redis client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
-
High 7.5
Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.
-
High 7.5
Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the Ala…
-
High 7.5
open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database…
-
High 8.2
Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body
The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in response_json_cb() (subsys/mgmt/hawkbit/hawkbit.c). The buffer is sized to hold the received body bytes but reser…
-
High 8.1
In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (pr…