Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-122 (堆缓冲区溢出) — Vulnerability Class 1863

1863 vulnerabilities classified as CWE-122 (堆缓冲区溢出). AI Chinese analysis included.

CWE-122 represents a critical memory safety weakness where an application writes data beyond the allocated boundaries of a heap-allocated buffer, typically created via functions like malloc. This vulnerability arises when developers fail to validate input lengths or perform insufficient bounds checking before copying data into dynamically allocated memory regions. Attackers exploit this flaw by crafting malicious inputs that exceed buffer limits, allowing them to overwrite adjacent heap metadata or control structures. Such overwrites can corrupt the heap manager’s internal state, leading to application crashes, data leakage, or arbitrary code execution by hijacking control flow. To prevent heap-based buffer overflows, developers must rigorously validate all input sizes against buffer capacities, utilize safe string handling libraries that enforce length limits, and employ modern memory-safe programming languages that automatically manage memory boundaries, thereby eliminating manual pointer arithmetic errors.

MITRE CWE Description
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Common Consequences (3)
AvailabilityDoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Integrity, Confidentiality, Availability, Access ControlExecute Unauthorized Code or Commands, Bypass Protection Mechanism, Modify Memory
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. Besides important user data, heap-based overflows can be used to overwrite function pointers that may be living in memory, pointing it to the attacker's code. Eve…
Integrity, Confidentiality, Availability, Access Control, OtherExecute Unauthorized Code or Commands, Bypass Protection Mechanism, Other
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
Mitigations (5)
Pre-design: Use a language or compiler that performs automatic bounds checking.
Architecture and DesignUse an abstraction library to abstract away risky APIs. Not a complete solution.
Operation, Build and CompilationUse automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses…
Effectiveness: Defense in Depth
Operation, Build and CompilationRun or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code. Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported…
Effectiveness: Defense in Depth
ImplementationImplement and perform bounds checking on input.
Examples (2)
While buffer overflow examples can be rather complex, it is possible to have very simple, yet still exploitable, heap-based buffer overflows:
#define BUFSIZE 256 int main(int argc, char **argv) { char *buf; buf = (char *)malloc(sizeof(char)*BUFSIZE); strcpy(buf, argv[1]); }
Bad · C
This example applies an encoding procedure to an input string and stores it into a buffer.
char * copy_input(char *user_supplied_string){ int i, dst_index; char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE); if ( MAX_SIZE <= strlen(user_supplied_string) ){ die("user string too long, die evil hacker!"); } dst_index = 0; for ( i = 0; i < strlen(user_supplied_string); i++ ){ if( '&' == user_supplied_string[i] ){ dst_buf[dst_index++] = '&'; dst_buf[dst_index++] = 'a'; dst_buf[dst_index++] = 'm'; dst_buf[dst_index++] = 'p'; dst_buf[dst_index++] = ';'; } else if ('<' == user_supplied_string[i] ){ /* encode to &lt; */ } else dst_buf[dst_index++] = user_supplied_string[i]; } return ds
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2021-41253 Possible heap buffer overflow when using zycore string functions in formatter hooks — zydis 5.9 Medium2021-11-08
CVE-2021-3927 Heap-based Buffer Overflow in vim/vim — vim/vim 7.8 -2021-11-05
CVE-2021-22564 Out of bounds Copy in Libjxl in large image groups — libjxl 4.5 Medium2021-11-01
CVE-2021-3756 Heap-based Buffer Overflow in hoene/libmysofa — hoene/libmysofa 8.8 -2021-10-29
CVE-2021-3903 Heap-based Buffer Overflow in vim/vim — vim/vim 7.8 -2021-10-27
CVE-2021-34583 CODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS) — CODESYS V2 7.5 High2021-10-26
CVE-2021-3872 Heap-based Buffer Overflow in vim/vim — vim/vim 7.8 -2021-10-19
CVE-2021-33023 Advantech WebAccess — WebAccess 9.8 Critical2021-10-18
CVE-2021-3875 Heap-based Buffer Overflow in vim/vim — vim/vim 7.8 -2021-10-15
CVE-2021-21940 Anker Eufy Homebase 缓冲区错误漏洞 — Anker 10.0 -2021-10-12
CVE-2021-37199 Siemens Sinumerik 808D 缓冲区错误漏洞 — SINUMERIK 808D 7.5 -2021-10-12
CVE-2021-25495 Samsung Notes 缓冲区错误漏洞 — Samsung Notes 7.3 High2021-10-06
CVE-2021-25479 Samsung SMR 缓冲区错误漏洞 — Samsung Mobile Devices 7.2 High2021-10-06
CVE-2021-25475 Samsung SMR 缓冲区错误漏洞 — Samsung Mobile Devices 3.9 Low2021-10-06
CVE-2021-31986 Axis Os 缓冲区错误漏洞 — AXIS OS 6.8 -2021-10-05
CVE-2021-3625 Buffer overflow in Zephyr USB DFU DNLOAD — zephyr 9.6 Critical2021-10-05
CVE-2021-32626 Lua scripts can overflow the heap-based Lua stack in Redis — redis 7.5 High2021-10-04
CVE-2021-36051 XMP Toolkit SDK Buffer Overflow Could Lead To Arbitrary Code Execution — XMP Toolkit 7.8 High2021-10-04
CVE-2021-39863 Adobe Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution — Acrobat Reader 7.8 High2021-09-29
CVE-2021-39823 svg-native-viewer Heap Buffer overflow Vulnerability — SVG Native Viewer 7.8 High2021-09-27
CVE-2021-32959 AVEVA SuiteLink Server Buffer Overflow — AVEVA System Platform 2020 8.1 High2021-09-23
CVE-2021-34770 Cisco IOS XE Software for Catalyst 9000 Family Wireless Controllers CAPWAP Remote Code Execution Vulnerability — Cisco IOS XE Software 10.0 Critical2021-09-23
CVE-2021-38404 Delta Electronics DOPSoft 2 Heap-based Buffer Overflow — DOPSoft 2 7.8 High2021-09-17
CVE-2021-3778 Heap-based Buffer Overflow in vim/vim — vim/vim 7.8 -2021-09-15
CVE-2021-25449 SAMSUNG Mobile devices 缓冲区错误漏洞 — Samsung Mobile Devices 6.5 Medium2021-09-09
CVE-2021-26603 bandisoft ARK library heap overflow vulnerability — ARK 8.6 High2021-09-09
CVE-2021-3770 Heap-based Buffer Overflow in vim/vim — vim/vim 7.8 -2021-09-06
CVE-2021-28560 Adobe Acrobat Reader heap corruption vulnerability could lead to arbitrary code execution — Acrobat Reader 8.8 High2021-09-02
CVE-2021-28558 Adobe Acrobat Reader heap-based buffer overflow could lead to arbitrary code execution — Acrobat Reader 8.8 -2021-09-02
CVE-2021-36073 Adobe Bridge SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability — Bridge 7.8 High2021-09-01

Vulnerabilities classified as CWE-122 (堆缓冲区溢出) represent 1863 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.