CWE-122
AllowedHeap-based Buffer Overflow
Abstraction: Variant · Status: Draft
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
4097 vulnerabilities reference this CWE, most recent first.
GHSA-9J2Q-RV22-36XM
Vulnerability from github – Published: 2025-05-13 18:30 – Updated: 2025-05-13 18:30Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.
{
"affected": [],
"aliases": [
"CVE-2025-30388"
],
"database_specific": {
"cwe_ids": [
"CWE-122",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-13T17:16:01Z",
"severity": "HIGH"
},
"details": "Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.",
"id": "GHSA-9j2q-rv22-36xm",
"modified": "2025-05-13T18:30:57Z",
"published": "2025-05-13T18:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30388"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30388"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9J3W-6HG7-6C6J
Vulnerability from github – Published: 2024-10-08 18:33 – Updated: 2024-10-08 18:33Windows Mobile Broadband Driver Remote Code Execution Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-43523"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-08T18:15:15Z",
"severity": "MODERATE"
},
"details": "Windows Mobile Broadband Driver Remote Code Execution Vulnerability",
"id": "GHSA-9j3w-6hg7-6c6j",
"modified": "2024-10-08T18:33:15Z",
"published": "2024-10-08T18:33:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43523"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43523"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9J54-8GMH-M2JR
Vulnerability from github – Published: 2024-07-11 00:32 – Updated: 2024-07-11 00:32A Heap-based Buffer Overflow vulnerability in the telemetry sensor process (sensord) of Juniper Networks Junos OS on MX240, MX480, MX960 platforms using MPC10E causes a steady increase in memory utilization, ultimately leading to a Denial of Service (DoS).
When the device is subscribed to a specific subscription on Junos Telemetry Interface, a slow memory leak occurs and eventually all resources are consumed and the device becomes unresponsive. A manual reboot of the Line Card will be required to restore the device to its normal functioning.
This issue is only seen when telemetry subscription is active.
The Heap memory utilization can be monitored using the following command: > show system processes extensive
The following command can be used to monitor the memory utilization of the specific sensor > show system info | match sensord PID NAME MEMORY PEAK MEMORY %CPU THREAD-COUNT CORE-AFFINITY UPTIME
1986 sensord 877.57MB 877.57MB 2 4 0,2-15 7-21:41:32
This issue affects Junos OS:
- from 21.2R3-S5 before 21.2R3-S7,
- from 21.4R3-S4 before 21.4R3-S6,
- from 22.2R3 before 22.2R3-S4,
- from 22.3R2 before 22.3R3-S2,
- from 22.4R1 before 22.4R3,
- from 23.2R1 before 23.2R2.
{
"affected": [],
"aliases": [
"CVE-2024-39518"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-10T23:15:11Z",
"severity": "HIGH"
},
"details": "A Heap-based Buffer Overflow vulnerability in the telemetry sensor process (sensord) of Juniper Networks Junos OS on MX240, MX480, MX960 platforms using MPC10E causes a steady increase in memory utilization, ultimately leading to a Denial of Service (DoS).\n\nWhen the device is subscribed to a specific subscription on Junos Telemetry Interface, a slow memory leak occurs and eventually all resources are consumed and the device becomes unresponsive. A manual reboot of the Line Card will be required to restore the device to its normal functioning.\u00a0\n\nThis issue is only seen when telemetry subscription is active.\n\nThe Heap memory utilization can be monitored using the following command:\n\u00a0 \u003e show system processes extensive\n\nThe following command can be used to monitor the memory utilization of the specific sensor\n\u00a0 \u003e show system info | match sensord\n PID NAME MEMORY PEAK MEMORY %CPU THREAD-COUNT CORE-AFFINITY UPTIME\n\n 1986 sensord 877.57MB 877.57MB 2 4 0,2-15 7-21:41:32\n\n\nThis issue affects Junos OS:\u00a0\n\n\n\n * from 21.2R3-S5 before 21.2R3-S7,\u00a0\n * from 21.4R3-S4 before 21.4R3-S6,\u00a0\n * from 22.2R3 before 22.2R3-S4,\u00a0\n * from 22.3R2 before 22.3R3-S2,\u00a0\n * from 22.4R1 before 22.4R3,\u00a0\n * from 23.2R1 before 23.2R2.",
"id": "GHSA-9j54-8gmh-m2jr",
"modified": "2024-07-11T00:32:50Z",
"published": "2024-07-11T00:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39518"
},
{
"type": "WEB",
"url": "https://supportportal.juniper.net/JSA82982"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9J79-6MCV-2W43
Vulnerability from github – Published: 2022-02-23 00:00 – Updated: 2022-03-17 00:05Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.
{
"affected": [],
"aliases": [
"CVE-2022-0676"
],
"database_specific": {
"cwe_ids": [
"CWE-122",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-22T00:15:00Z",
"severity": "HIGH"
},
"details": "Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.",
"id": "GHSA-9j79-6mcv-2w43",
"modified": "2022-03-17T00:05:24Z",
"published": "2022-02-23T00:00:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0676"
},
{
"type": "WEB",
"url": "https://github.com/radareorg/radare2/commit/c84b7232626badd075caf3ae29661b609164bac6"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/5ad814a1-5dd3-43f4-869b-33b8dab78485"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E6YBRQ3UCFWJVSOYIKPVUDASZ544TFND"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9J79-XCX5-MXM4
Vulnerability from github – Published: 2024-07-09 18:30 – Updated: 2024-07-09 18:30Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-38077"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-09T17:15:42Z",
"severity": "CRITICAL"
},
"details": "Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability",
"id": "GHSA-9j79-xcx5-mxm4",
"modified": "2024-07-09T18:30:52Z",
"published": "2024-07-09T18:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38077"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38077"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9JFX-65HV-G39H
Vulnerability from github – Published: 2025-11-11 21:30 – Updated: 2025-11-11 21:30Format Plugins versions 1.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2025-61838"
],
"database_specific": {
"cwe_ids": [
"CWE-122",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-11T19:15:35Z",
"severity": "HIGH"
},
"details": "Format Plugins versions 1.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-9jfx-65hv-g39h",
"modified": "2025-11-11T21:30:27Z",
"published": "2025-11-11T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61838"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/formatplugins/apsb25-114.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9JGC-VW8W-2XV8
Vulnerability from github – Published: 2026-06-09 18:30 – Updated: 2026-06-09 18:30Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
{
"affected": [],
"aliases": [
"CVE-2026-45469"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-09T17:17:21Z",
"severity": "HIGH"
},
"details": "Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.",
"id": "GHSA-9jgc-vw8w-2xv8",
"modified": "2026-06-09T18:30:49Z",
"published": "2026-06-09T18:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45469"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45469"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9JQJ-4CR8-RR2F
Vulnerability from github – Published: 2026-02-03 21:31 – Updated: 2026-02-04 00:30Heap buffer overflow in libvpx in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
{
"affected": [],
"aliases": [
"CVE-2026-1861"
],
"database_specific": {
"cwe_ids": [
"CWE-122",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-03T21:16:12Z",
"severity": "HIGH"
},
"details": "Heap buffer overflow in libvpx in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-9jqj-4cr8-rr2f",
"modified": "2026-02-04T00:30:28Z",
"published": "2026-02-03T21:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1861"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/478942410"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9JWX-QJPV-CFRV
Vulnerability from github – Published: 2026-07-14 18:32 – Updated: 2026-07-14 18:32Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-50332"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T18:17:32Z",
"severity": "HIGH"
},
"details": "Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-9jwx-qjpv-cfrv",
"modified": "2026-07-14T18:32:16Z",
"published": "2026-07-14T18:32:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50332"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50332"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9M39-3MF3-XWCH
Vulnerability from github – Published: 2025-08-08 00:30 – Updated: 2026-05-07 13:25A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "executorch"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.pytorch:executorch-android"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "SwiftURL",
"name": "github.com/pytorch/executorch"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-54949"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-12T18:49:44Z",
"nvd_published_at": "2025-08-07T23:15:26Z",
"severity": "CRITICAL"
},
"details": "A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be",
"id": "GHSA-9m39-3mf3-xwch",
"modified": "2026-05-07T13:25:19Z",
"published": "2025-08-08T00:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54949"
},
{
"type": "WEB",
"url": "https://github.com/pytorch/executorch/commit/ede82493dae6d2d43f8c424e7be4721abe5242be"
},
{
"type": "PACKAGE",
"url": "https://github.com/pytorch/executorch"
},
{
"type": "WEB",
"url": "https://www.facebook.com/security/advisories/cve-2025-54949"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "ExecuTorch heap buffer overflow vulnerability"
}
Mitigation
Pre-design: Use a language or compiler that performs automatic bounds checking.
Mitigation
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation MIT-10
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation MIT-11
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Mitigation
Implement and perform bounds checking on input.
Mitigation
Strategy: Libraries or Frameworks
Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
Mitigation
Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth.
CAPEC-92: Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.