cve.bz

CWE-122: Heap-based Buffer Overflow, page 9

Filter

The product writes past the end of a buffer that was allocated on the heap.

What the weakness is: CWE-122 at MITRE

Ask an AI about CWE-122

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-122: Heap-based Buffer Overflow and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/122.html and https://cve.bz/cve/cwe/122?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-104344EPSS 0.2%

    Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a …

  2. 7.8CVE-2026-104340EPSS 0.2%

    Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a …

  3. 7.8CVE-2026-103966EPSS 0.2%

    Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a …

  4. 7.8CVE-2026-103568EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.

  5. 7.0CVE-2026-103555EPSS 0.3%

    Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.

  6. 8.8CVE-2026-102858EPSS 0.9%

    Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.

  7. 8.8CVE-2026-102857EPSS 0.9%

    Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.

  8. 8.8CVE-2026-102856EPSS 0.9%

    Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.

  9. 8.8CVE-2026-102850EPSS 0.8%

    Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

  10. 8.8CVE-2026-102849EPSS 0.8%

    Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

  11. 7.8CVE-2026-102227EPSS 0.4%

    Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

  12. 7.8CVE-2026-102218EPSS 0.4%

    Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

  13. 7.8CVE-2026-102215EPSS 0.4%

    Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

  14. 9.8CVE-2026-102210EPSS 1.0%

    Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.

  15. 7.0CVE-2026-102209EPSS 0.3%

    Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

  16. 6.8CVE-2026-102206EPSS 0.5%

    Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to elevate privileges with a physical attack.

  17. 7.8CVE-2026-102205EPSS 0.4%

    Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

  18. 7.0CVE-2026-102191EPSS 0.3%

    Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.

  19. 7.0CVE-2026-102189EPSS 0.3%

    Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.

  20. 7.0CVE-2026-100225EPSS 0.3%

    Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.

  21. 9.8CVE-2026-100222EPSS 1.1%

    Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.

  22. 8.8CVE-2026-100220EPSS 0.9%

    Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.

  23. 7.8CVE-2026-100215EPSS 0.5%

    Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.

  24. 8.8CVE-2026-100210EPSS 0.9%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  25. 7.0CVE-2026-100203EPSS 0.3%

    Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.

  26. 7.0CVE-2026-100201EPSS 0.3%

    Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.

  27. 8.7CVE-2026-77100EPSS 0.3%

    MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.

  28. 7.1CVE-2026-74045EPSS 0.3%

    Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap me…

  29. 4.4CVE-2026-67456EPSS 0.1%

    NVIDIA Warp contains a vulnerability where an attacker could cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to denial of service.

  30. 7.1CVE-2026-35001EPSS 0.1%

    OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. An attacker can supply a crafted S-102 HDF5 file with malicious grid dimension metadata that causes memory corruption when …

  31. 5.9CVE-2026-103658EPSS 0.2%

    GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((in…

  32. 6.0CVE-2026-109256EPSS 0.3%

    FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CF_DIB image that triggers out-of-bou…

  33. 6.1CVE-2026-109255EPSS 0.5%

    FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVER_LICENSE_REQ…

  34. 5.5CVE-2026-108978EPSS 0.1%

    Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables. This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.

  35. 9.8CVE-2026-103501EPSS 0.6%

    Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in LIST mode, from either a byte buffer or a stream, the coupon count was read from the input and used…

  36. 4.9CVE-2026-96396EPSS 0.10%

    The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overfl…

  37. 5.5CVE-2026-107651EPSS 0.2%

    A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could exploit this flaw by enticing a user into ope…

  38. 6.4CVE-2026-106177EPSS 0.1%

    A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP has released version 4.4.33 to address this vulnerability.

  39. 6.5CVE-2026-95125EPSS 0.3%

    libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. A crafted SWF file with a malformed or truncated RECT header can cause a denial of service.

  40. 9.8CVE-2026-14888EPSS 0.4%

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow.

  41. 9.8CVE-2026-14269EPSS 0.5%

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote…

  42. 6.5CVE-2026-103011EPSS 0.2%

    Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user to cause a denial of serv…

  43. 7.8CVE-2026-103010EPSS 0.2%

    Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows allows a local interactive user with no hMailServer credentials to …

  44. 8.5CVE-2026-87679EPSS 0.4%

    When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable num…

  45. 7.5CVE-2026-107161EPSS 0.4%

    A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not re…

  46. 9.8CVE-2026-76471EPSS 0.5%

    A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device.  The v…

  47. 6.5CVE-2026-106574EPSS 0.2%

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculatio…

  48. 5.3CVE-2026-106564EPSS 0.4%

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixe…

  49. 8.1CVE-2026-46570EPSS 0.2%

    In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is tr…

  50. 2.1CVE-2026-107125EPSS 0.3%

    A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument starting_line causes heap-based buffer overflow. Remote exploitation of the attack is possi…