cve.bz

CWE-122: Heap-based Buffer Overflow, page 2

Filter

The product writes past the end of a buffer that was allocated on the heap.

What the weakness is: CWE-122 at MITRE

Ask an AI about CWE-122

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-122: Heap-based Buffer Overflow and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/122.html and https://cve.bz/cve/cwe/122?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.2CVE-2026-112403EPSS 0.9%

    Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count…

  2. 9.2CVE-2026-112398EPSS 0.7%

    Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unre…

  3. 8.2CVE-2026-112395EPSS 0.5%

    Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row strid…

  4. 9.2CVE-2026-112393EPSS 1.0%

    Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as Byte…

  5. 5.5CVE-2025-60480EPSS 0.2%

    A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

  6. 5.4CVE-2026-11831EPSS 0.2%

    IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request.

  7. 8.8CVE-2026-10574EPSS 0.4%

    IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.

  8. 8.8CVE-2026-10572EPSS 0.4%

    IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.

  9. 6.9CVE-2026-112280EPSS 0.1%

    libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a …

  10. 8.1CVE-2026-111441EPSS 0.4%

    在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >= …

  11. 8.7CVE-2026-112021EPSS 0.7%

    snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a sin…

  12. 5.5CVE-2025-55640EPSS 0.2%

    A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

  13. 6.8CVE-2026-111458EPSS 0.09%

    The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:se…

  14. 7.0CVE-2026-111381EPSS 0.2%

    FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent ca…

  15. 7.0CVE-2026-111379EPSS 0.2%

    FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height v…

  16. 8.8CVE-2026-108451EPSS 0.6%

    Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  17. 8.8CVE-2026-108450EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  18. 8.8CVE-2026-108449EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  19. 7.5CVE-2026-108448EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  20. 8.8CVE-2026-108447EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  21. 8.8CVE-2026-108444EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.

  22. 8.8CVE-2026-108441EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  23. 8.8CVE-2026-108439EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  24. 8.8CVE-2026-108437EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  25. 8.8CVE-2026-108432EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  26. 8.8CVE-2026-108430EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  27. 8.8CVE-2026-108429EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  28. 8.8CVE-2026-108428EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  29. 8.8CVE-2026-108427EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  30. 8.8CVE-2026-108426EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  31. 7.8CVE-2026-55246EPSS 0.2%

    bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for byte-…

  32. 9.3CVE-2026-110958EPSS 1.0%

    A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The expl…

  33. 6.6CVE-2026-79831EPSS 0.1%

    A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution.

  34. 7.1CVE-2026-79828EPSS 0.1%

    A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow.

  35. 7.1CVE-2026-79827EPSS 0.1%

    A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.

  36. 7.1CVE-2026-79826EPSS 0.1%

    A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.

  37. 7.1CVE-2026-79825EPSS 0.1%

    A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.

  38. 7.1CVE-2026-79822EPSS 0.1%

    A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.

  39. 8.2CVE-2026-101307EPSS 0.3%

    When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into…

  40. 6.1CVE-2026-110837EPSS 0.4%

    FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A mali…

  41. 8.8CVE-2026-63626EPSS 0.2%

    Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCP…

  42. 8.7CVE-2026-103994EPSS 0.4%

    A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execu…

  43. 9.3CVE-2026-102175EPSS 0.7%

    A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connecti…

  44. 8.7CVE-2026-102015EPSS 0.3%

    A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EA…

  45. 9.3CVE-2026-101950EPSS 0.5%

    A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise confidentiality and integrity via…

  46. 8.6CVE-2026-101927EPSS 0.1%

    A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of service (DoS) or achieve privilege escalation to root via cr…

  47. 9.2CVE-2026-93479EPSS 1.2%

    A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Altern…

  48. 9.2CVE-2026-15176EPSS 0.8%

    A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same …

  49. 2.0CVE-2026-73791EPSS 0.2%

    A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow.

  50. 8.8CVE-2026-110166EPSS 0.3%

    Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)