cve.bz

CWE-122: Heap-based Buffer Overflow, page 33

Filter

The product writes past the end of a buffer that was allocated on the heap.

What the weakness is: CWE-122 at MITRE

Ask an AI about CWE-122

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-122: Heap-based Buffer Overflow and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/122.html and https://cve.bz/cve/cwe/122?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.3CVE-2026-32149EPSS 0.3%

    Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally.

  2. 7.0CVE-2026-32093EPSS 1.1%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

  3. 7.0CVE-2026-32087EPSS 0.3%

    Heap-based buffer overflow in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

  4. 7.8CVE-2026-26180EPSS 0.3%

    Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

  5. 7.8CVE-2026-26176EPSS 0.2%

    Heap-based buffer overflow in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to elevate privileges locally.

  6. 7.8CVE-2026-26156EPSS 0.4%

    Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally.

  7. 5.5CVE-2026-27286EPSS 0.2%

    InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in mem…

  8. 5.5CVE-2026-27285EPSS 0.1%

    InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application or disrup…

  9. 7.8CVE-2026-27238EPSS 0.2%

    InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user intera…

  10. 8.1CVE-2026-22828EPSS 0.9%

    A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.6.2 through 7.6.4 may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically craft…

  11. 5.5CVE-2026-40310EPSS 0.2%

    ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below both 7.1.2-19 and 6.9.13-44, contain a heap out-of-bounds write in the JP2 encoder with when a user specifies an invalid sampling…

  12. 5.5CVE-2026-40183EPSS 0.2%

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, the JXL encoder has an heap write overflow when a user specifies that the image should be encoded as 16 bit floats. …

  13. 5.5CVE-2026-40169EPSS 0.2%

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, a crafted image could result in an out of bounds heap write when writing a yaml or json output, resulting in a crash…

  14. 7.5CVE-2026-33901EPSS 0.8%

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when…

  15. 5.3CVE-2026-33899EPSS 0.4%

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds.…

  16. 7.5CVE-2026-32316EPSS 0.8%

    jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31…

  17. 7.5CVE-2026-30999EPSS 0.5%

    A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

  18. 10.0CVE-2026-34865EPSS 0.2%

    Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

  19. 9.8CVE-2026-25205EPSS 0.2%

    Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows out-of-bounds write.This issue affects Escargot:commit hash  97e8115ab1110bc502b4b5e4a0c689a71520d335 .

  20. 7.8CVE-2026-4153EPSS 0.6%

    GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vuln…

  21. 7.8CVE-2026-4152EPSS 0.7%

    GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vuln…

  22. 5.5CVE-2026-29043EPSS 0.2%

    HDF5 is software for managing data. In 1.14.1-2 and earlier, an attacker who can control an h5 file parsed by HDF5 can trigger a write-based heap buffer overflow condition in the H5T__ref_mem_setnull method. This can lead to a denial-of-se…

  23. 2.3CVE-2026-5448EPSS 0.3%

    X.509 date buffer overflow in wolfSSL_X509_notAfter / wolfSSL_X509_notBefore. A buffer overflow may occur when parsing date fields from a crafted X.509 certificate via the compatibility layer API. This is only triggered when calling these …

  24. 8.3CVE-2026-5264EPSS 0.4%

    Heap buffer overflow in DTLS 1.3 ACK message processing. A remote attacker can send a crafted DTLS 1.3 ACK message that triggers a heap buffer overflow.

  25. 6.3CVE-2026-5447EPSS 0.3%

    Heap buffer overflow in CertFromX509 via AuthorityKeyIdentifier size confusion. A heap buffer overflow occurs when converting an X.509 certificate internally due to incorrect size handling of the AuthorityKeyIdentifier extension.

  26. 2.3CVE-2026-5187EPSS 0.3%

    Two potential heap out-of-bounds write locations existed in DecodeObjectId() in wolfcrypt/src/asn.c. First, a bounds check only validates one available slot before writing two OID arc values (out[0] and out[1]), enabling a 2-byte out-of-bo…

  27. 4.3CVE-2026-5869EPSS 0.2%

    Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

  28. 8.8CVE-2026-5868EPSS 0.3%

    Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

  29. 4.3CVE-2026-5867EPSS 0.3%

    Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

  30. 4.3CVE-2026-5864EPSS 0.2%

    Heap buffer overflow in WebAudio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

  31. 8.8CVE-2026-5858EPSS 0.6%

    Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

  32. 6.1CVE-2026-35199EPSS 0.3%

    SymCrypt is the core cryptographic function library currently used by Windows. From 103.5.0 to before 103.11.0, The SymCryptXmssSign function passes a 64-bit leaf count value to a helper function that accepts a 32-bit parameter. For XMSS^M…

  33. 7.8CVE-2026-21372EPSS 0.10%

    Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations.

  34. 5.3CVE-2026-34979EPSS 0.4%

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job att…

  35. 5.3CVE-2026-5474EPSS 0.4%

    A vulnerability was found in NASA cFS up to 7.0.0. This affects the function CFE_MSG_GetSize of the file apps/to_lab/fsw/src/to_lab_passthru_encode.c of the component CCSDS Packet Header Handler. Performing a manipulation results in heap-b…

  36. 9.8CVE-2026-31402EPSS 1.2%

    In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operatio…

  37. 1.7CVE-2026-34743EPSS 0.5%

    XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where …

  38. 7.1CVE-2026-34120EPSS 0.2%

    A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the asynchronous parsing of local video stream content due to insufficient alignment and validation of buffer boundaries when processing streaming…

  39. 7.1CVE-2026-34119EPSS 0.2%

    A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing loop when appending segmented request bodies without continuous write‑boundary verification, due to insufficient boundary validat…

  40. 7.1CVE-2026-34118EPSS 0.4%

    A heap-based buffer overflow vulnerability was identified in multiple TP-Link Tapo cameras in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation, due to insufficient boundary va…

  41. 5.5CVE-2026-5244EPSS 0.8%

    A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow…

  42. 8.4CVE-2026-34545EPSS 0.6%

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.7, an attacker providing a crafted .exr file with HTJ…

  43. 8.8CVE-2026-5275EPSS 0.4%

    Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

  44. 8.8CVE-2026-5272EPSS 0.6%

    Heap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

  45. 1.9CVE-2026-5236EPSS 0.2%

    A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_BitReader::SkipBits of the file Ap4Dac4Atom.cpp of the component DSI v1 Parser. Such manipulation of the argument n_presentations leads to hea…

  46. 1.9CVE-2026-5235EPSS 0.2%

    A vulnerability was determined in Axiomatic Bento4 up to 1.6.0-641. This impacts the function AP4_BitReader::ReadCache of the file Ap4Dac4Atom.cpp of the component MP4 File Parser. This manipulation causes heap-based buffer overflow. The a…

  47. 5.5CVE-2026-34540EPSS 0.2%

    iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a heap-buffer-overflow (HBO) in icMemDump() when iccDumpProfile attempts to dump/descr…

  48. 5.5CVE-2026-34539EPSS 0.2%

    iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile and TIFF input can trigger a heap-buffer-overflow (HBO) in CTiffImg::WriteLine(). The issue is obs…

  49. 5.5CVE-2026-34535EPSS 0.2%

    iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a segmentation fault (SEGV) in CIccTagArray::Cleanup(). The issue is observable under …

  50. 5.5CVE-2026-34534EPSS 0.1%

    iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a heap-buffer-overflow (HBO) in CIccMpeSpectralMatrix::Describe(). The issue is observ…