CWE-122: Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory.
Yearly Trend
Top Affected Vendors
All Heap-based Buffer Overflow CVEs (846)
A buffer overflow vulnerability in MongoDB's C driver library (libbson) allows attackers to cause segmentation faults and application crashes by creat...
Mar 18, 2025A heap-based buffer overflow vulnerability in Assimp versions before 5.4.3 allows local attackers to execute arbitrary code by importing a specially c...
Sep 18, 2024A heap-based buffer overflow vulnerability in 7-Zip's NTFS handler allows attackers to write two bytes beyond allocated buffer boundaries when process...
Jul 3, 2024A heap buffer overflow vulnerability in the dfs_v2 dfs_file component of RT-Thread allows attackers to execute arbitrary code or cause denial of servi...
Mar 27, 2024A heap buffer overflow vulnerability in RT-Thread's command shell components allows attackers to execute arbitrary code or cause denial of service. Th...
Mar 27, 2024CVE-2024-27209 is a heap buffer overflow vulnerability in Android that allows local privilege escalation without user interaction. Attackers can explo...
Mar 11, 2024A heap-based buffer overflow in glibc's syslog functions allows attackers to crash applications or potentially escalate privileges locally. This affec...
Jan 31, 2024This vulnerability in AMI's SPx BMC allows attackers on adjacent networks to trigger heap memory corruption via CWE-122 (Heap-based Buffer Overflow). ...
Jan 9, 2024This vulnerability in AMI's SPx BMC allows attackers on adjacent networks to cause heap memory corruption, potentially leading to remote code executio...
Jan 9, 2024This vulnerability in ImageMagick allows attackers to trigger an integer overflow when processing large UHDR images, leading to heap buffer overflow a...
Feb 24, 2026This vulnerability allows local attackers to trigger an out-of-bounds write in BitVisor's VirtIO network device emulation, potentially causing hypervi...
Oct 16, 2025CVE-2025-1943 is a heap-based buffer overflow vulnerability in Firefox and Thunderbird that could allow memory corruption. Attackers could potentially...
Mar 4, 2025A heap-based buffer overflow vulnerability in BMC firmware for specific Intel server boards allows privileged users to escalate privileges via local a...
Feb 12, 2025This vulnerability in Chrome's V8 JavaScript engine allows object corruption that could lead to heap corruption when processing malicious HTML pages. ...
Jan 22, 2025CVE-2023-39946 is a heap overflow vulnerability in eprosima Fast DDS that allows remote attackers to crash any Fast-DDS process by sending a specially...
Aug 11, 2023This CVE describes a heap-based buffer overflow vulnerability in the USB device class implementation in Zephyr RTOS. Attackers could exploit this to e...
Feb 7, 2022This is a heap-based buffer overflow vulnerability in Parallels Desktop's IDE virtual device that allows local attackers with high-privileged code exe...
Apr 29, 2021A heap-based buffer overflow vulnerability in libbiosig's Nicolet WFT file parser allows arbitrary code execution when processing malicious .wft files...
Mar 3, 2026A buffer overflow vulnerability in Qsync Central allows authenticated remote attackers to modify memory or crash processes. This affects all Qsync Cen...
Feb 11, 2026A heap buffer overflow vulnerability in ImageMagick's XBM image decoder allows attackers to write controlled data beyond allocated memory boundaries w...
Jan 20, 2026A heap-based buffer overflow vulnerability in multiple Fortinet products allows attackers to execute arbitrary code or commands via specially crafted ...
Jan 13, 2026A heap-based buffer overflow vulnerability in Avast Antivirus for macOS allows local attackers to execute arbitrary code or cause denial of service by...
Dec 1, 2025A heap buffer overflow vulnerability in Google Chrome's Sync component allows remote attackers to perform out-of-bounds memory reads via a crafted HTM...
Nov 6, 2025CVE-2025-3320 is a heap-based buffer overflow vulnerability in IBM Tivoli Monitoring that allows remote attackers to execute arbitrary code or crash t...
Aug 6, 2025This vulnerability allows remote attackers to execute arbitrary code on Windows systems running vulnerable LDAP implementations. Attackers can exploit...
Feb 11, 2025CVE-2024-6873 is a heap-based buffer overflow vulnerability in ClickHouse's native interface that allows unauthenticated attackers to crash the server...
Aug 1, 2024This vulnerability in Windows Cryptographic Services allows remote attackers to execute arbitrary code on affected systems by sending specially crafte...
May 14, 2024CVE-2023-5400 is a heap overflow vulnerability in Honeywell products where a malformed message with specific key values can cause memory corruption. T...
Apr 17, 2024A heap buffer overflow vulnerability exists in texlive-bin's ttfdump tool via the ttfLoadHDMX function. Attackers can exploit this by providing a spec...
Feb 29, 2024CVE-2022-26098 is a heap-based buffer overflow vulnerability in the sheifd_create function of Samsung's libsimba library that allows remote attackers ...
Apr 11, 2022A heap-based buffer overflow vulnerability in the parser_iloc function of Samsung's libsimba library allows remote attackers to execute arbitrary code...
Apr 11, 2022This vulnerability allows remote attackers to execute arbitrary code on affected Samsung devices through a heap-based buffer overflow in the libsimba ...
Apr 11, 2022A heap-based buffer overflow vulnerability in the parser_ipma function of Samsung's libsimba library allows remote attackers to execute arbitrary code...
Apr 11, 2022CVE-2021-21962 is a heap-based buffer overflow vulnerability in the OTA Update functionality of Sealevel Systems SeaConnect 370W. Attackers can exploi...
Feb 4, 2022This vulnerability is a heap-based buffer overflow in the SuiteLink server when processing commands 0x05/0x06. It allows remote attackers to execute a...
Sep 23, 2021This vulnerability is a heap-based buffer overflow in dnsmasq before version 2.83 that occurs during DNSSEC validation of RRSets. An attacker who can ...
Jan 20, 2021A heap-based buffer overflow vulnerability in TP-Link Archer AX53 v1.0 routers allows attackers on the same network to crash the device or potentially...
Feb 3, 2026A heap-based buffer overflow vulnerability in TP-Link Archer AX53 v1.0 routers allows authenticated attackers on the same network to crash the device ...
Feb 3, 2026A heap-based buffer overflow vulnerability in TP-Link Archer AX53 v1.0 routers allows authenticated attackers on the same network to crash the device ...
Feb 3, 2026A heap-based buffer overflow vulnerability in TP-Link Archer AX53 v1.0 routers allows authenticated attackers on the same network to crash the device ...
Feb 3, 2026A heap-based buffer overflow in TP-Link Archer AX53 v1.0's tmpserver modules allows authenticated attackers on the same network to crash the device or...
Feb 3, 2026A heap-based buffer overflow in TP-Link Archer AX53 v1.0's tmpserver modules allows authenticated attackers on the same network to crash the device or...
Feb 3, 2026A heap-based buffer overflow vulnerability in TP-Link Archer AX53 v1.0 routers allows authenticated attackers on the same network to crash the device ...
Feb 3, 2026A heap-based buffer overflow vulnerability in TP-Link Archer AX53 v1.0 routers allows authenticated attackers on the same network to crash the device ...
Feb 3, 2026This CVE describes a heap-based buffer overflow in the tmpserver modules of TP-Link Archer AX53 v1.0 routers. Authenticated attackers on the same loca...
Feb 3, 2026This CVE describes a heap buffer overflow vulnerability in the NrmmDecoder component of Android's media framework. An attacker could exploit this to e...
Dec 11, 2025A heap-based buffer overflow vulnerability in Windows Routing and Remote Access Service (RRAS) allows authenticated attackers to execute arbitrary cod...
Nov 11, 2025A heap-based buffer overflow vulnerability in Windows Routing and Remote Access Service (RRAS) allows authenticated attackers to execute arbitrary cod...
Nov 11, 2025This CVE describes a critical vulnerability in MediaTek WLAN AP drivers where an incorrect bounds check allows out-of-bounds write. Attackers within w...
Nov 4, 2025A heap-based buffer overflow vulnerability in Windows Routing and Remote Access Service (RRAS) allows authenticated attackers to execute arbitrary cod...
Aug 12, 2025About Heap-based Buffer Overflow (CWE-122)
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory.
Our database tracks 846 CVEs classified as CWE-122, with 107 rated critical and 660 rated high severity. The average CVSS score for Heap-based Buffer Overflow vulnerabilities is 8.0.
External reference: View CWE-122 on MITRE CWE →
Monitor Heap-based Buffer Overflow Vulnerabilities
Get alerted when new Heap-based Buffer Overflow CVEs affect your infrastructure.
Start Monitoring Free