Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-122 (堆缓冲区溢出) — Vulnerability Class 1863

1863 vulnerabilities classified as CWE-122 (堆缓冲区溢出). AI Chinese analysis included.

CWE-122 represents a critical memory safety weakness where an application writes data beyond the allocated boundaries of a heap-allocated buffer, typically created via functions like malloc. This vulnerability arises when developers fail to validate input lengths or perform insufficient bounds checking before copying data into dynamically allocated memory regions. Attackers exploit this flaw by crafting malicious inputs that exceed buffer limits, allowing them to overwrite adjacent heap metadata or control structures. Such overwrites can corrupt the heap manager’s internal state, leading to application crashes, data leakage, or arbitrary code execution by hijacking control flow. To prevent heap-based buffer overflows, developers must rigorously validate all input sizes against buffer capacities, utilize safe string handling libraries that enforce length limits, and employ modern memory-safe programming languages that automatically manage memory boundaries, thereby eliminating manual pointer arithmetic errors.

MITRE CWE Description
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Common Consequences (3)
AvailabilityDoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Integrity, Confidentiality, Availability, Access ControlExecute Unauthorized Code or Commands, Bypass Protection Mechanism, Modify Memory
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. Besides important user data, heap-based overflows can be used to overwrite function pointers that may be living in memory, pointing it to the attacker's code. Eve…
Integrity, Confidentiality, Availability, Access Control, OtherExecute Unauthorized Code or Commands, Bypass Protection Mechanism, Other
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
Mitigations (5)
Pre-design: Use a language or compiler that performs automatic bounds checking.
Architecture and DesignUse an abstraction library to abstract away risky APIs. Not a complete solution.
Operation, Build and CompilationUse automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses…
Effectiveness: Defense in Depth
Operation, Build and CompilationRun or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code. Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported…
Effectiveness: Defense in Depth
ImplementationImplement and perform bounds checking on input.
Examples (2)
While buffer overflow examples can be rather complex, it is possible to have very simple, yet still exploitable, heap-based buffer overflows:
#define BUFSIZE 256 int main(int argc, char **argv) { char *buf; buf = (char *)malloc(sizeof(char)*BUFSIZE); strcpy(buf, argv[1]); }
Bad · C
This example applies an encoding procedure to an input string and stores it into a buffer.
char * copy_input(char *user_supplied_string){ int i, dst_index; char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE); if ( MAX_SIZE <= strlen(user_supplied_string) ){ die("user string too long, die evil hacker!"); } dst_index = 0; for ( i = 0; i < strlen(user_supplied_string); i++ ){ if( '&' == user_supplied_string[i] ){ dst_buf[dst_index++] = '&'; dst_buf[dst_index++] = 'a'; dst_buf[dst_index++] = 'm'; dst_buf[dst_index++] = 'p'; dst_buf[dst_index++] = ';'; } else if ('<' == user_supplied_string[i] ){ /* encode to &lt; */ } else dst_buf[dst_index++] = user_supplied_string[i]; } return ds
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2022-4584 Axiomatic Bento4 mp42aac heap-based overflow — Bento4 6.3 Medium2022-12-17
CVE-2022-2601 grub2 安全漏洞 — grub2 8.6 -2022-12-14
CVE-2022-2948 GE CIMPLICITY Heap-based Buffer Overflow — CIMPLICITY 7.8 High2022-12-07
CVE-2022-3491 Heap-based Buffer Overflow in vim/vim — vim/vim 7.8 -2022-12-03
CVE-2022-3520 Heap-based Buffer Overflow in vim/vim — vim/vim 7.8 -2022-12-02
CVE-2022-4141 Heap-based Buffer Overflow in vim/vim — vim/vim 7.8 -2022-11-25
CVE-2022-20946 Cisco Firepower Threat Defense 缓冲区错误漏洞 — Cisco Firepower Threat Defense Software 8.6 High2022-11-10
CVE-2022-39136 Siemens JT2Go和Teamcenter Visualization 缓冲区错误漏洞 — JT2Go 7.8 High2022-11-08
CVE-2022-24942 Heap-based buffer overflow in MicriumOS HTTP Server allows potential remote code execution — Gecko Platform 9.1 Critical2022-11-02
CVE-2022-2069 Datalogics APDFL library Heap-based Buffer Overflow — JT2Go 7.8 High2022-10-20
CVE-2022-35711 Adobe ColdFusion ODBC Server Heap-based Buffer Overflow Remote Code Execution Vulnerability — ColdFusion 9.8 Critical2022-10-14
CVE-2022-35712 Adobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution Vulnerability — ColdFusion 9.8 Critical2022-10-14
CVE-2022-37864 Siemens Solid Edge 缓冲区错误漏洞 — Solid Edge 7.8 -2022-10-11
CVE-2022-39852 SAMSUNG Mobile devices 缓冲区错误漏洞 — Samsung Mobile Devices 8.0 High2022-10-07
CVE-2022-38742 Rockwell Automation ThinManager Software Vulnerable to Arbitrary Code Execution and Denial-Of-Service Attack — ThinManager ThinServer 8.1 High2022-09-23
CVE-2022-2347 Unchecked Download size in Uboot — Uboot 7.7 High2022-09-23
CVE-2022-2566 Heap-memory write in FFMPEG — FFMPEG 9.0 Critical2022-09-23
CVE-2022-36934 WhatsApp 输入验证错误漏洞 — WhatsApp for iOS 9.8 -2022-09-22
CVE-2022-35708 Adobe Bridge SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability — Bridge 7.8 High2022-09-19
CVE-2022-35706 Adobe Bridge SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability — Bridge 7.8 High2022-09-19
CVE-2022-3234 Heap-based Buffer Overflow in vim/vim — vim/vim 7.8 -2022-09-17
CVE-2022-38413 Adobe InDesign SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability — InDesign 7.8 High2022-09-16
CVE-2022-38415 Adobe InDesign PCX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability — InDesign 7.8 High2022-09-16
CVE-2022-38414 Adobe InDesign SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability — InDesign 7.8 High2022-09-16
CVE-2022-38432 Adobe Photoshop SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability — Photoshop 7.8 High2022-09-16
CVE-2022-38433 Adobe Photoshop SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability — Photoshop 7.8 High2022-09-16
CVE-2022-38401 Adobe InCopy PCX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability — InCopy 7.8 High2022-09-16
CVE-2022-38405 Adobe InCopy SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability — InCopy 7.8 High2022-09-16
CVE-2022-38404 Adobe InCopy SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability — InCopy 7.8 High2022-09-16
CVE-2022-38411 Adobe Animate SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability — Animate 7.8 High2022-09-16

Vulnerabilities classified as CWE-122 (堆缓冲区溢出) represent 1863 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.