Weakness (CWE)
CWE-122: Heap-based Buffer Overflow
The product writes past the end of a buffer that was allocated on the heap.
How to prevent it (7 mitigations)
-
Pre-design: Use a language or compiler that performs automatic bounds checking.
-
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
-
Operation, Build and Compilation
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
-
Operation, Build and Compilation
Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
-
Implementation
Implement and perform bounds checking on input.
-
Implementation
Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
-
Operation
Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth.
Source: MITRE CWE-122
650 results · Clear filters · Feed
-
Medium 6.8
Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability
Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authenticatio…
-
Medium 5.3
X.Org Server GestureBuildSprite Use-After-Free
A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.
-
Medium 4.9
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through …
-
Medium 5.4
Buffer overflow in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code in…
-
Medium 4.3
Buffer overflow in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code insid…
-
Medium 6.8CVE-2026-116488 Public exploit
NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descript…
-
Medium 5.4
libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow
A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is p…
-
Medium 6.3
libimobiledevice AFC afc.c heap-based overflow
A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly availa…
-
Medium 6.3
GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow
A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The att…
-
Medium 6.4
Heap-based Buffer Overflow in ntpsec
Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.
-
Medium 5.5
A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/M…
-
Medium 6.5
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the …
-
Medium 5.4
IBM MQ Heap-based Buffer Overflow
IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request.
-
Medium 6.1
libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body
libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadc…
-
Medium 5.5
A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-…
-
Medium 6.8
ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting
The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha2…
-
Medium 5.5
A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cau…
-
Medium 6.6
HPE NonStop Posix User Threads - Heap buffer overflow vulnerability
A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution.
-
Medium 5.9
Remotely triggerable buffer overflow in tcp_rack
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffe…
-
Medium 6.7
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
-
Medium 6.4
Microsoft SQL Server Elevation of Privilege Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
-
Medium 6.6
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
Medium 6.7
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Heap-based buffer overflow in DNS Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Windows Hyper-V Information Disclosure Vulnerability
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information over a network.
-
Medium 6.8
Windows Portable Device MTP Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to elevate privileges with a physical attack.
-
Medium 6.7
Windows Distributed File System (DFS) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally.
-
Medium 6.8
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an unauthorized attacker to elevate privileges with a physical attack.
-
Medium 5.5
Windows Kernel Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
Medium 6.6
Windows Installer Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges with a physical attack.
-
Medium 6.8
Windows Storage Port Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.
-
Medium 6.7
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Windows Biometric Service Information Disclosure Vulnerability
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to disclose information locally.
-
Medium 6.8
Windows Overlay Filter Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code with a physical attack.
-
Medium 6.8
Windows Overlay Filter Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code with a physical attack.
-
Medium 4.4
NVIDIA Warp contains a vulnerability where an attacker could cause a heap-based buffer overflow. A successful exploit o…
-
Medium 5.9
GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in it…
-
Medium 5.3
FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion
FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CF_DIB image that triggers out-of-bounds memcpy during PN…
-
Medium 6.8CVE-2026-109255 Public exploit
FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length
FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVER_LICENSE_REQUEST with a large sc…
-
Medium 5.5
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables…