Weakness (CWE)
CWE-122: Heap-based Buffer Overflow
The product writes past the end of a buffer that was allocated on the heap.
How to prevent it (7 mitigations)
-
Pre-design: Use a language or compiler that performs automatic bounds checking.
-
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
-
Operation, Build and Compilation
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
-
Operation, Build and Compilation
Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
-
Implementation
Implement and perform bounds checking on input.
-
Implementation
Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
-
Operation
Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth.
Source: MITRE CWE-122
2,891 results · Clear filters · Feed
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
High 7.8
X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write
A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
-
High 7.8
X.Org Server Glamor CopyArea Heap Buffer Overflow
A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.
-
High 7.0
USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS
USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in USB Test/src/driveinfo.cpp trusts DISK_GEOMETRY.BytesPerSector returned by IOCTL_D…
-
High 7.5
SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array
SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the `bcp_api.cpp` loop over the JSON `sockets` array uses `slot_data["sockets"].Size()` without bounding …
-
High 7.8
X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow
A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.
-
High 7.8
X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server c…
-
High 7.8
X.Org Server XFixes Pointer Barrier Event List Buffer Overflow
A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
-
High 7.8
X.Org Server XKB ResizeKeyType Numeric Truncation
An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.
-
High 8.5
X.Org Server GLX RenderLarge Heap Buffer Overflow
A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server co…
-
High 8.8
Buffer overflow in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code i…
-
High 7.8
Tanium addressed a heap-based buffer overflow vulnerability in Index.
Tanium addressed a heap-based buffer overflow vulnerability in Index.
-
High 7.7
Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `memcpy` of `OGG/Speex` packet data in `format_ogg_speex` can cause a he…
-
High 7.5
libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
-
High 7.5
libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow
A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.
-
High 8.8
A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in…
-
High 7.5
A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2…
-
High 8.8CVE-2026-92208 Public exploit
NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability
NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.…
-
High 8.9
Sharp before 0.35.4 RCE via bundled libheif AVIF decoding
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted i…
-
High 8.8
FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FOR…
-
High 8.8
Buffer overflow in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arb…
-
High 8.8
Buffer overflow in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbit…
-
High 8.8
Buffer overflow in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially…
-
High 7.1
Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag
Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-…
-
High 7.5
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execut…
-
High 8.8
IBM MQ Buffer Overflow
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.
-
High 8.8
IBM MQ Buffer Overflow
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.
-
High 8.1
HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写
在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >= lenUsed，也将 memcpy_s(…
-
High 7.5
snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted applicat…
-
High 7.3
FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with ove…
-
High 7.3
FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the …
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 7.5
Microsoft Office Outlook Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.