cve.bz

CWE-122: Heap-based Buffer Overflow

Filter

The product writes past the end of a buffer that was allocated on the heap.

What the weakness is: CWE-122 at MITRE

Ask an AI about CWE-122

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-122: Heap-based Buffer Overflow and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/122.html and https://cve.bz/cve/cwe/122?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.7CVE-2026-120208EPSS 0.4%

    libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers …

  2. 8.4CVE-2026-102212EPSS 0.3%

    Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances allows an unauthenticated remote attacker to crash the index.cgi process via a crafted multipart/form-dat…

  3. 6.5CVE-2026-119727EPSS 0.3%

    A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underfl…

  4. 5.8CVE-2026-110133EPSS 0.2%

    A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attack…

  5. 7.5CVE-2026-9536EPSS 0.3%

    A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to …

  6. 8.8CVE-2026-96199EPSS 0.6%

    Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

  7. 8.8CVE-2026-96198EPSS 0.6%

    Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

  8. 8.8CVE-2026-85897EPSS 0.6%

    Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

  9. 4.8CVE-2026-119124EPSS 0.1%

    ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with th…

  10. 5.3CVE-2026-93536EPSS 0.2%

    A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially e…

  11. 7.8CVE-2026-93523EPSS 0.2%

    A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code…

  12. 6.8CVE-2026-118611EPSS 0.3%

    Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 de…

  13. 7.8CVE-2026-93522EPSS 0.2%

    A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server c…

  14. 7.8CVE-2026-93521EPSS 0.2%

    A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.

  15. 7.5CVE-2026-47235EPSS 0.2%

    SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the `bcp_api.cpp` loop over the JSON `sockets` array uses `slot_data["sockets"].Size(…

  16. 7.0CVE-2026-116776EPSS 0.2%

    USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in USB Test/src/driveinfo.cpp trusts DISK_GEOMETRY.BytesPerSector…

  17. 7.8CVE-2026-93520EPSS 0.2%

    A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execu…

  18. 7.8CVE-2026-93519EPSS 0.2%

    A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

  19. 7.8CVE-2026-93518EPSS 0.2%

    An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution …

  20. 8.5CVE-2026-93517EPSS 0.2%

    A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code exec…

  21. 4.9CVE-2026-86392EPSS 0.3%

    Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain…

  22. 7.8CVE-2026-108307EPSS 0.1%

    Tanium addressed a heap-based buffer overflow vulnerability in Index.

  23. 2.3CVE-2026-57198EPSS 0.8%

    Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code exe…

  24. 7.7CVE-2026-57197EPSS 0.5%

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `memcpy` of `OGG/Speex` packet data in `format_ogg_s…

  25. 7.5CVE-2026-109090EPSS 0.3%

    A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.

  26. 7.5CVE-2026-109089EPSS 0.3%

    A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.

  27. 9.2CVE-2026-112710EPSS 0.4%

    A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potenti…

  28. 9.2CVE-2026-112709EPSS 0.4%

    A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially ex…

  29. 9.4CVE-2026-86576EPSS 0.5%

    Heap-based Buffer Overflow Vulnerability in JP1 Products. This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job…

  30. 9.8CVE-2026-86574EPSS 0.5%

    Heap-based Buffer Overflow Vulnerability in JP1/Base. This issue affects JP1/Base: from 11-00 before 12-50-54.

  31. 9.8CVE-2026-82120EPSS 0.4%

    Heap-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 t…

  32. 9.8CVE-2026-76939EPSS 0.5%

    Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 b…

  33. 9.4CVE-2026-76937EPSS 0.5%

    Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.

  34. 9.4CVE-2026-76933EPSS 0.5%

    Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 b…

  35. 8.8CVE-2026-116837EPSS 0.2%

    A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.

  36. 7.0CVE-2026-116488EPSS 0.4%

    NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can sup…

  37. 2.1CVE-2026-116262EPSS 0.3%

    A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buff…

  38. 2.1CVE-2026-116258EPSS 0.2%

    A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploi…

  39. 5.3CVE-2026-116124EPSS 0.4%

    A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buff…

  40. 4.8CVE-2026-116160EPSS 0.1%

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation …

  41. 9.8CVE-2026-78846EPSS 0.4%

    Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing.

  42. 8.8CVE-2026-92208EPSS 0.6%

    NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit…

  43. 9.8CVE-2026-111183EPSS 0.7%

    GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to…

  44. 6.4CVE-2026-102484EPSS 0.2%

    Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.

  45. 5.5CVE-2025-60490EPSS 0.2%

    A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

  46. 8.9CVE-2026-114112EPSS 0.2%

    Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications pr…

  47. 8.7CVE-2026-114045EPSS 0.6%

    FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client c…

  48. 9.1CVE-2026-10136EPSS 0.6%

    A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker ca…

  49. 7.1CVE-2025-71436EPSS 0.5%

    Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, T…

  50. 7.5CVE-2026-43855EPSS 0.5%

    A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.