cve.bz

CWE-122: Heap-based Buffer Overflow, page 23

Filter

The product writes past the end of a buffer that was allocated on the heap.

What the weakness is: CWE-122 at MITRE

Ask an AI about CWE-122

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-122: Heap-based Buffer Overflow and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/122.html and https://cve.bz/cve/cwe/122?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-61926EPSS 0.3%

    Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.

  2. 7.8CVE-2026-61923EPSS 0.3%

    Heap-based buffer overflow in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally.

  3. 5.5CVE-2026-61368EPSS 0.4%

    Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information locally.

  4. 8.1CVE-2026-61363EPSS 0.7%

    Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

  5. 7.8CVE-2026-61359EPSS 0.3%

    Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.

  6. 7.8CVE-2026-61355EPSS 0.3%

    Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

  7. 7.8CVE-2026-61353EPSS 0.3%

    Heap-based buffer overflow in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

  8. 8.1CVE-2026-59134EPSS 0.7%

    Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

  9. 7.8CVE-2026-58651EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  10. 7.8CVE-2026-54984EPSS 0.5%

    Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.

  11. 7.0CVE-2026-50472EPSS 0.3%

    Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.

  12. 8.1CVE-2026-48440EPSS 1.3%

    ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue …

  13. 6.9CVE-2026-21399EPSS 0.1%

    Heap-based buffer overflow for the Intel(R) Open Volume Kernel Library (Intel(R) Open VKL) library maintained by intel(R) before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with a…

  14. 8.5CVE-2026-73072EPSS 0.1%

    Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOF…

  15. 7.1CVE-2026-68293EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords (128 bytes) when the device advertises the mcia_32dwords capab…

  16. 4.8CVE-2026-18370EPSS 0.2%

    entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer based on the r…

  17. 1.9CVE-2026-19259EPSS 0.2%

    A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMapping_varAccessSpecToObjectReference of the file src/iec61850/common/iec61850_common.c of the component MMS Protocol Workflo…

  18. 7.1CVE-2026-18497EPSS 0.2%

    A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_t…

  19. 1.9CVE-2026-19206EPSS 0.2%

    A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiver_stopThreadless of the file src/sampled_values/sv_subscriber.c of the component ASDU Element Handler. Performing a manipulati…

  20. 6.2CVE-2026-18938EPSS 0.1%

    A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalcul…

  21. 8.5CVE-2026-70638EPSS 0.2%

    llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max parameter without overflow …

  22. 7.5CVE-2026-19156EPSS 0.2%

    Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security sever…

  23. 8.3CVE-2026-19138EPSS 0.3%

    Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity…

  24. 7.5CVE-2026-34502EPSS 0.5%

    Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.

  25. 7.5CVE-2026-34501EPSS 0.5%

    Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the is…

  26. 9.8CVE-2026-67873EPSS 0.7%

    A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegment_encode() validates only the standalone segment length via FileSegment_GetMaxDataSize() and does…

  27. 7.5CVE-2026-67867EPSS 0.5%

    Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the Alarm/Conditions wrapper when processing PublishResponse EventNotificationList data

  28. 7.5CVE-2026-67860EPSS 0.5%

    open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend.

  29. 9.3CVE-2017-20241EPSS 1.3%

    Keysight IxChariot Endpoint before 9.5.102 contains a heap-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet to crash the endpoint or potentially execute arbitrary code.

  30. 1.9CVE-2026-18784EPSS 0.2%

    A vulnerability was found in o6 open62541 up to 1.5.5. This issue affects the function UA_Client_readNodeClassAttribute of the file src/client/ua_client_highlevel.c. Performing a manipulation results in heap-based buffer overflow. Attackin…

  31. 7.5CVE-2026-10849EPSS 0.5%

    The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in response_json_cb() (subsys/mgmt/hawkbit/hawkbit.c). The buffer is sized to hold the received …

  32. 5.3CVE-2026-18585EPSS 0.5%

    A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. …

  33. 5.5CVE-2026-20480EPSS 0.1%

    In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10960023 …

  34. 8.1CVE-2026-20465EPSS 0.3%

    In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed …

  35. 7.7CVE-2026-68580EPSS 0.3%

    FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attacker…

  36. 9.4CVE-2026-67305EPSS 0.8%

    FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs without validating the server-provided size against the destination buf…

  37. 7.1CVE-2026-54715EPSS 0.4%

    GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. In version 1.10.2, parse_browser assumes the matched browser token begins with Opera and moves a trailing versi…

  38. 8.8CVE-2026-17951EPSS 0.4%

    Heap buffer overflow in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)

  39. 8.8CVE-2026-17935EPSS 0.5%

    Heap buffer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

  40. 9.6CVE-2026-17758EPSS 0.4%

    Heap buffer overflow in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

  41. 9.6CVE-2026-17680EPSS 0.4%

    Heap buffer overflow in Color in Google Chrome on ChromeOS prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severi…

  42. 6.8CVE-2026-13307EPSS 0.3%

    Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite…

  43. 7.8CVE-2026-14266EPSS 0.7%

    7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vu…

  44. 7.8CVE-2026-64558EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey_pckmo handler implementation Explicitly check the length of the target buffer in the pkey_pckmo implementation of the key_to_protkey() ha…

  45. 9.3CVE-2026-67191EPSS 1.0%

    Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A …

  46. 7.8CVE-2026-16463EPSS 0.3%

    A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the …

  47. 7.8CVE-2026-48372EPSS 0.3%

    Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a ma…

  48. 9.3CVE-2026-55971EPSS 1.0%

    Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

  49. 7.7CVE-2026-64524EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolution_count and fix WIN8 fallback A SYNTHVID_RESOLUTION_RESPONSE with resolution_count > 64 walks past the supported_resolution[SYNTHVID_MAX_RE…

  50. 8.7CVE-2026-66040EPSS 0.8%

    FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf…