cve.bz

CWE-122: Heap-based Buffer Overflow, page 31

Filter

The product writes past the end of a buffer that was allocated on the heap.

What the weakness is: CWE-122 at MITRE

Ask an AI about CWE-122

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-122: Heap-based Buffer Overflow and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/122.html and https://cve.bz/cve/cwe/122?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.3CVE-2026-8525EPSS 0.2%

    Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

  2. 8.8CVE-2026-8509EPSS 0.4%

    Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)

  3. 7.8CVE-2026-44636EPSS 0.1%

    libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, signed integer overflow in sixel_encode_highcolor's allocation size calculation can lead to a heap buffer overflow. The public sixel_encode e…

  4. 8.5CVE-2026-43906EPSS 0.2%

    OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of…

  5. 7.2CVE-2026-0264EPSS 0.5%

    A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all PAN-OS platforms excep…

  6. 9.2CVE-2026-42945EPSS 68%

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Express…

  7. 8.8CVE-2025-62624EPSS 0.1%

    A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

  8. 7.5CVE-2026-23827EPSS 0.5%

    A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could allow an unauthentica…

  9. 7.8CVE-2026-42896EPSS 0.3%

    Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

  10. 7.8CVE-2026-42831EPSS 0.4%

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  11. 9.8CVE-2026-41096EPSS 2.7%

    Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.

  12. 7.8CVE-2026-40407EPSS 0.3%

    Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

  13. 8.8CVE-2026-40403EPSS 0.4%

    Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.

  14. 7.8CVE-2026-40398EPSS 2.7%

    Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

  15. 6.2CVE-2026-40380EPSS 0.5%

    Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack.

  16. 7.8CVE-2026-40377EPSS 0.3%

    Heap-based buffer overflow in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally.

  17. 8.4CVE-2026-40364EPSS 4.4%

    Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  18. 8.4CVE-2026-40363EPSS 0.4%

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  19. 7.8CVE-2026-40362EPSS 0.3%

    Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  20. 7.8CVE-2026-35421EPSS 0.5%

    Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally.

  21. 7.8CVE-2026-35420EPSS 0.3%

    Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

  22. 7.8CVE-2026-34687EPSS 0.2%

    Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction…

  23. 7.8CVE-2026-34642EPSS 0.2%

    After Effects versions 26.0, 25.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interacti…

  24. 7.8CVE-2026-34343EPSS 0.3%

    Heap-based buffer overflow in Windows Application Identity (AppID) Subsystem allows an authorized attacker to elevate privileges locally.

  25. 7.8CVE-2026-34336EPSS 0.2%

    Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

  26. 8.8CVE-2026-34329EPSS 0.5%

    Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network.

  27. 7.8CVE-2026-33841EPSS 0.3%

    Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

  28. 7.8CVE-2026-33837EPSS 1.8%

    Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

  29. 7.3CVE-2026-32177EPSS 0.6%

    Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.

  30. 7.3CVE-2025-12659EPSS 0.2%

    Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted IPT files. This could allow an attacker to execute code in the context of the current process.

  31. 7.8CVE-2026-42046EPSS 0.4%

    libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacker to cause a controlled heap out-of-bounds write (heap overflow) by supplying a …

  32. 8.4CVE-2026-4892EPSS 0.8%

    A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet.

  33. 2.0CVE-2026-8261EPSS 0.2%

    A vulnerability was determined in Squirrel up to 3.2. This affects the function SQFunctionProto::Load of the file squirrel/sqobject.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The …

  34. 1.9CVE-2026-8213EPSS 0.3%

    A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hdf-eos/GDapi.c of the component Grid File Handler. The manipulation leads to heap-based buffer overf…

  35. 1.9CVE-2026-8212EPSS 0.2%

    A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires …

  36. 5.1CVE-2026-42309EPSS 0.1%

    Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could ca…

  37. 5.5CVE-2026-45130EPSS 0.2%

    Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled len…

  38. 7.8CVE-2026-43329EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload a…

  39. 6.9CVE-2026-41509EPSS 0.3%

    CROSS implementation contains reference and optimized implementations of the CROSS post-quantum signature algorithm. Prior to commit fc6b7e7, there is a buffer overflow in crypto_sign_open() caused by an underflow of the integer mlen. This…

  40. 1.9CVE-2026-8087EPSS 0.2%

    A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow.…

  41. 1.9CVE-2026-8086EPSS 0.2%

    A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file frmts/hdf4/hdf-eos/SWapi.c. Such manipulation of the argument DimensionName leads to heap-based buffer overflow. The att…

  42. 8.3CVE-2026-7900EPSS 0.2%

    Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

  43. 7.7CVE-2026-20185EPSS 0.4%

    A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco 350 Series Managed Switches (SG350) and Cisco 350X Series Stackable Managed Switches (SG350X) firmware could allow an authenticated, remote attac…

  44. 8.7CVE-2026-6210EPSS 0.3%

    A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* with…

  45. 9.8CVE-2026-43186EPSS 0.6%

    In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to decide how much data to write for…

  46. 7.8CVE-2026-43150EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: perf/arm-cmn: Reject unsupported hardware configurations So far we've been fairly lax about accepting both unknown CMN models (at least with a warning), and unknown revi…

  47. 9.8CVE-2026-28780EPSS 1.4%

    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker co…

  48. 7.7CVE-2026-25589EPSS 1.7%

    RedisBloom is a probabilistic data structures module for Redis. In all versions of RedisBloom before 2.8.20, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker wit…

  49. 7.7CVE-2026-25588EPSS 1.3%

    RedisTimeSeries is a time-series module for Redis. In all versions before 1.12.14 of RedisTimeSeries, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permi…

  50. 7.7CVE-2026-25243EPSS 4.0%

    Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serial…