cve.bz

CWE-122: Heap-based Buffer Overflow, page 12

Filter

The product writes past the end of a buffer that was allocated on the heap.

What the weakness is: CWE-122 at MITRE

Ask an AI about CWE-122

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-122: Heap-based Buffer Overflow and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/122.html and https://cve.bz/cve/cwe/122?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.9CVE-2026-54559EPSS 0.5%

    PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in src/lm/ngram_model_trie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format headers, and the acoustic-model loaders …

  2. 7.7CVE-2026-19499EPSS 0.3%

    Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that …

  3. 1.9CVE-2026-90682EPSS 0.2%

    A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAG_GPS_LAT/TAG_GPS_LONG le…

  4. 4.2CVE-2026-23788EPSS 0.1%

    An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, and 1380. A heap overflow in the Exynos DRM HDR driver (due to improper buffer size validation) leads to kernel memory corruption and a system crash.

  5. 2.5CVE-2025-64031EPSS 0.2%

    libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. E…

  6. 1.9CVE-2026-90577EPSS 0.2%

    A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer …

  7. 8.5CVE-2026-90556EPSS 0.2%

    Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that…

  8. 7.4CVE-2026-54241EPSS 0.4%

    libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16…

  9. 7.5CVE-2026-79393EPSS 0.7%

    A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to caus…

  10. 6.1CVE-2026-18495EPSS 0.1%

    A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing …

  11. 7.8CVE-2026-79591EPSS 0.2%

    A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3 due to insufficient validation of a file-controlled font index.

  12. 3.3CVE-2026-45761EPSS 0.2%

    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow whi…

  13. 9.5CVE-2026-44950EPSS 0.3%

    fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does n…

  14. 8.0CVE-2026-42807EPSS 0.3%

    A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allows attackers to cause a denial of service (process crash) or potentially execute arbitrary code. …

  15. 9.8CVE-2026-85103EPSS 4.3%

    A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.

  16. 7.1CVE-2026-21104EPSS 0.1%

    Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code.

  17. 9.2CVE-2026-21096EPSS 0.8%

    Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.

  18. 9.2CVE-2026-21095EPSS 0.8%

    Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.

  19. 9.6CVE-2026-87654EPSS 0.4%

    Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

  20. 8.8CVE-2026-87579EPSS 0.6%

    Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  21. 9.6CVE-2026-87527EPSS 0.5%

    Buffer overflow in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

  22. 8.8CVE-2026-87430EPSS 0.6%

    Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

  23. 8.2CVE-2026-53938EPSS 0.2%

    OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms (`alg` = `A128KW`, `A192KW`, `A256KW`) does…

  24. 5.5CVE-2026-81993EPSS 0.3%

    Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue require…

  25. 7.8CVE-2026-81992EPSS 0.3%

    Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a ma…

  26. 7.8CVE-2026-82006EPSS 0.3%

    Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a…

  27. 5.5CVE-2026-86716EPSS 0.6%

    A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skip_spaces_and_comments of the file src/mjs_tok.c. Executing a manipulation can lead to heap-based buffer overflow. The attack can be launched remotely. Th…

  28. 7.8CVE-2026-58820EPSS 0.10%

    In multiple locations, there is a possible memory safety issue due to integer overflow. This could lead to local escalation of privilege with no additional execution privileges required.

  29. 7.8CVE-2026-55294EPSS 0.10%

    In ihevcd_get_tu_data_size of ihevcd_utils.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not n…

  30. 7.8CVE-2026-49932EPSS 0.10%

    In parseParts of PduParser.java, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for expl…

  31. 9.8CVE-2026-49921EPSS 0.4%

    In multiple locations, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

  32. 8.8CVE-2026-49882EPSS 0.4%

    In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for explo…

  33. 7.8CVE-2026-45531EPSS 0.10%

    In read_boot_region of fsck.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploi…

  34. 7.8CVE-2026-45515EPSS 0.10%

    In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges neede…

  35. 8.0CVE-2026-28662EPSS 0.2%

    In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User in…

  36. 8.8CVE-2026-28618EPSS 0.4%

    In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

  37. 7.8CVE-2026-85880KEVEPSS 0.4%

    Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

  38. 8.8CVE-2026-85877EPSS 0.8%

    Heap-based buffer overflow in Windows Print Spooler Components allows an unauthorized attacker to execute code over a network.

  39. 7.8CVE-2026-84000EPSS 0.3%

    Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to execute code locally.

  40. 8.8CVE-2026-83998EPSS 0.8%

    Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

  41. 8.8CVE-2026-83996EPSS 0.3%

    Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

  42. 7.8CVE-2026-83995EPSS 0.3%

    Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

  43. 8.8CVE-2026-83992EPSS 0.8%

    Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

  44. 7.8CVE-2026-83988EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  45. 7.8CVE-2026-83987EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  46. 7.8CVE-2026-83986EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  47. 7.8CVE-2026-83985EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  48. 7.8CVE-2026-83983EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  49. 7.8CVE-2026-83982EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  50. 7.8CVE-2026-83981EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.