CWE-122
Heap-based Buffer Overflow
Description
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-92
CVEs mapped to this weakness (2,687)
page 105 of 135| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-7104 | Med | 0.36 | 5.5 | 0.01 | Dec 29, 2023 | A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is… | ||
| CVE-2023-47051 | Med | 0.36 | 5.5 | 0.00 | Nov 16, 2023 | Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim… | ||
| CVE-2023-40166 | Med | 0.36 | 5.5 | 0.00 | Aug 25, 2023 | Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager::detectLanguageFromTextBegining `. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory… | ||
| CVE-2023-2157 | Med | 0.36 | 5.5 | 0.01 | Jun 6, 2023 | A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing. | ||
| CVE-2022-42783 | Med | 0.36 | 5.5 | 0.00 | Feb 12, 2023 | In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services. | ||
| CVE-2022-44430 | Med | 0.36 | 5.5 | 0.00 | Jan 4, 2023 | In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services. | ||
| CVE-2022-44429 | Med | 0.36 | 5.5 | 0.00 | Jan 4, 2023 | In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services. | ||
| CVE-2022-44428 | Med | 0.36 | 5.5 | 0.00 | Jan 4, 2023 | In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services. | ||
| CVE-2022-44427 | Med | 0.36 | 5.5 | 0.00 | Jan 4, 2023 | In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services. | ||
| CVE-2021-26330 | Med | 0.36 | 5.5 | 0.00 | Nov 16, 2021 | AMD System Management Unit (SMU) may experience a heap-based overflow which may result in a loss of resources. | ||
| CVE-2021-36056 | Med | 0.36 | 5.5 | 0.04 | Sep 1, 2021 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file. | ||
| CVE-2020-27841 | Med | 0.36 | 5.5 | 0.01 | Jan 5, 2021 | There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpeg encoder, this could cause an out-of-bounds read. The greatest impact from this flaw is to application availability. | ||
| CVE-2020-25674 | Med | 0.36 | 5.5 | 0.01 | Dec 8, 2020 | WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buffer-overflow. This occurs because it is possible for the colormap to have less than 256 valid values but the loop condition will… | ||
| CVE-2020-25667 | Med | 0.36 | 5.5 | 0.01 | Dec 8, 2020 | TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for `"dc:format=\"image/dng\"` within `profile` due to improper string handling, when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type… | ||
| CVE-2020-25665 | Med | 0.36 | 5.5 | 0.01 | Dec 8, 2020 | The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytes_per_row in the call to… | ||
| CVE-2020-13494 | Med | 0.36 | 5.5 | 0.01 | Dec 2, 2020 | A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 parsing of compressed string tokens in binary USD files. A specially crafted malformed file can trigger a heap overflow which can result in out of bounds memory access which could lead to information disclosure.… | ||
| CVE-2026-15165 | Med | 0.35 | 5.5 | 0.00 | Jul 8, 2026 | TLS ECH decryptor crash in Wireshark 4.6.0 to 4.6.6 allows denial of service | ||
| CVE-2026-45696 | Med | 0.35 | 6.5 | 0.00 | Jun 18, 2026 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.11, the HTJ2K (High-Throughput JPEG 2000) decoder, ht_undo_impl() in OpenEXRCore is vulnerable to a heap-buffer-overflow… | ||
| CVE-2026-11604 | Med | 0.35 | 6.5 | 0.00 | Jun 10, 2026 | An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash… | ||
| CVE-2026-48135 | Med | 0.35 | 5.3 | 0.03 | May 26, 2026 | A Check Point HTTP-based service can incorrectly handle malformed HTTP requests. The issue is related to HTTP request parsing and validation. |
- risk 0.36cvss 5.5epss 0.01
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is…
- risk 0.36cvss 5.5epss 0.00
Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
- risk 0.36cvss 5.5epss 0.00
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager::detectLanguageFromTextBegining `. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory…
- risk 0.36cvss 5.5epss 0.01
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
- risk 0.36cvss 5.5epss 0.00
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
- risk 0.36cvss 5.5epss 0.00
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
- risk 0.36cvss 5.5epss 0.00
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
- risk 0.36cvss 5.5epss 0.00
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
- risk 0.36cvss 5.5epss 0.00
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
- risk 0.36cvss 5.5epss 0.00
AMD System Management Unit (SMU) may experience a heap-based overflow which may result in a loss of resources.
- risk 0.36cvss 5.5epss 0.04
XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.
- risk 0.36cvss 5.5epss 0.01
There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpeg encoder, this could cause an out-of-bounds read. The greatest impact from this flaw is to application availability.
- risk 0.36cvss 5.5epss 0.01
WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buffer-overflow. This occurs because it is possible for the colormap to have less than 256 valid values but the loop condition will…
- risk 0.36cvss 5.5epss 0.01
TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for `"dc:format=\"image/dng\"` within `profile` due to improper string handling, when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type…
- risk 0.36cvss 5.5epss 0.01
The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytes_per_row in the call to…
- risk 0.36cvss 5.5epss 0.01
A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 parsing of compressed string tokens in binary USD files. A specially crafted malformed file can trigger a heap overflow which can result in out of bounds memory access which could lead to information disclosure.…
- risk 0.35cvss 5.5epss 0.00
TLS ECH decryptor crash in Wireshark 4.6.0 to 4.6.6 allows denial of service
- risk 0.35cvss 6.5epss 0.00
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.11, the HTJ2K (High-Throughput JPEG 2000) decoder, ht_undo_impl() in OpenEXRCore is vulnerable to a heap-buffer-overflow…
- risk 0.35cvss 6.5epss 0.00
An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash…
- risk 0.35cvss 5.3epss 0.03
A Check Point HTTP-based service can incorrectly handle malformed HTTP requests. The issue is related to HTTP request parsing and validation.