Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-122 (堆缓冲区溢出) — Vulnerability Class 1863

1863 vulnerabilities classified as CWE-122 (堆缓冲区溢出). AI Chinese analysis included.

CWE-122 represents a critical memory safety weakness where an application writes data beyond the allocated boundaries of a heap-allocated buffer, typically created via functions like malloc. This vulnerability arises when developers fail to validate input lengths or perform insufficient bounds checking before copying data into dynamically allocated memory regions. Attackers exploit this flaw by crafting malicious inputs that exceed buffer limits, allowing them to overwrite adjacent heap metadata or control structures. Such overwrites can corrupt the heap manager’s internal state, leading to application crashes, data leakage, or arbitrary code execution by hijacking control flow. To prevent heap-based buffer overflows, developers must rigorously validate all input sizes against buffer capacities, utilize safe string handling libraries that enforce length limits, and employ modern memory-safe programming languages that automatically manage memory boundaries, thereby eliminating manual pointer arithmetic errors.

MITRE CWE Description
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Common Consequences (3)
AvailabilityDoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Integrity, Confidentiality, Availability, Access ControlExecute Unauthorized Code or Commands, Bypass Protection Mechanism, Modify Memory
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. Besides important user data, heap-based overflows can be used to overwrite function pointers that may be living in memory, pointing it to the attacker's code. Eve…
Integrity, Confidentiality, Availability, Access Control, OtherExecute Unauthorized Code or Commands, Bypass Protection Mechanism, Other
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
Mitigations (5)
Pre-design: Use a language or compiler that performs automatic bounds checking.
Architecture and DesignUse an abstraction library to abstract away risky APIs. Not a complete solution.
Operation, Build and CompilationUse automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses…
Effectiveness: Defense in Depth
Operation, Build and CompilationRun or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code. Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported…
Effectiveness: Defense in Depth
ImplementationImplement and perform bounds checking on input.
Examples (2)
While buffer overflow examples can be rather complex, it is possible to have very simple, yet still exploitable, heap-based buffer overflows:
#define BUFSIZE 256 int main(int argc, char **argv) { char *buf; buf = (char *)malloc(sizeof(char)*BUFSIZE); strcpy(buf, argv[1]); }
Bad · C
This example applies an encoding procedure to an input string and stores it into a buffer.
char * copy_input(char *user_supplied_string){ int i, dst_index; char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE); if ( MAX_SIZE <= strlen(user_supplied_string) ){ die("user string too long, die evil hacker!"); } dst_index = 0; for ( i = 0; i < strlen(user_supplied_string); i++ ){ if( '&' == user_supplied_string[i] ){ dst_buf[dst_index++] = '&'; dst_buf[dst_index++] = 'a'; dst_buf[dst_index++] = 'm'; dst_buf[dst_index++] = 'p'; dst_buf[dst_index++] = ';'; } else if ('<' == user_supplied_string[i] ){ /* encode to &lt; */ } else dst_buf[dst_index++] = user_supplied_string[i]; } return ds
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2026-30982 iccDEV has a heap out-of-bounds read in CIccPcsXform::pushXYZConvert() — iccDEV 6.1 Medium2026-03-10
CVE-2026-26108 Microsoft Excel Remote Code Execution Vulnerability — Microsoft 365 Apps for Enterprise 7.8 High2026-03-10
CVE-2026-23665 Linux Azure Diagnostic extension (LAD) Elevation of Privilege Vulnerability — Azure Linux Virtual Machines with Azure Diagnostics extension 7.8 High2026-03-10
CVE-2026-25188 Windows Telephony Service Elevation of Privilege Vulnerability — Windows 10 Version 1607 8.8 High2026-03-10
CVE-2026-24288 Windows Mobile Broadband Driver Remote Code Execution Vulnerability — Windows 10 Version 21H2 6.8 Medium2026-03-10
CVE-2026-24283 Multiple UNC Provider Kernel Driver Elevation of Privilege Vulnerability — Windows 11 Version 24H2 8.8 High2026-03-10
CVE-2026-30937 ImageMagick has a heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes_per_line calculation — ImageMagick 6.8 Medium2026-03-09
CVE-2026-30936 ImageMagick has a heap Buffer Overflow in WaveletDenoiseImage — ImageMagick 5.5 Medium2026-03-09
CVE-2026-30931 ImageMagick has a heap-based buffer overflow in UHDR encoder — ImageMagick 6.8 Medium2026-03-09
CVE-2026-28686 ImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output buffer — ImageMagick 6.8 Medium2026-03-09
CVE-2026-3713 pnggroup libpng pnm2png pnm2png.c do_pnm2png heap-based overflow — libpng 5.3 Medium2026-03-08
CVE-2026-28546 Huawei HarmonyOS 安全漏洞 — HarmonyOS 5.9 Medium2026-03-05
CVE-2026-3544 Google Chrome 安全漏洞 — Chrome 8.8AIHighAI2026-03-04
CVE-2026-20053 Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Heap Overflow Denial of Service Vulnerability — Cisco Cyber Vision 5.8 Medium2026-03-04
CVE-2026-29022 mackron / dr_libs dr_wav.h Heap Buffer Overflow via WAV File — dr_libs dr_wav.h 7.3 High2026-03-03
CVE-2026-22891 libbiosig 安全漏洞 — libbiosig 9.8 Critical2026-03-03
CVE-2026-20777 libbiosig 安全漏洞 — libbiosig 8.1 High2026-03-03
CVE-2026-3463 xlnt-community xlnt Compound Document binary.hpp append heap-based overflow — xlnt 3.3 Low2026-03-03
CVE-2026-3407 YosysHQ yosys BLIF File rtlil.h set heap-based overflow — yosys 3.3 Low2026-03-02
CVE-2026-3393 jarikomppa soloud Audio File soloud_wav.cpp loadflac heap-based overflow — soloud 3.3 Low2026-03-01
CVE-2026-28420 Vim has Heap-based Buffer Overflow and OOB Read in :terminal — vim 4.4 Medium2026-02-27
CVE-2026-28418 Vim has Heap-based Buffer Overflow in Emacs tags parsing — vim 4.4 Medium2026-02-27
CVE-2026-3281 libvips bandrank.c vips_bandrank_build heap-based overflow — libvips 5.3 Medium2026-02-27
CVE-2026-2597 Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes() — Crypt::SysRandom::XS 9.8AICriticalAI2026-02-26
CVE-2026-23750 Golioth Pouch < [INSERT FIXED VERSION] BLE GATT Heap-based Buffer Overflow — Pouch 8.1 High2026-02-26
CVE-2026-27799 ImageMagick has a heap Buffer Over-read in its DJVU image format handler — ImageMagick 4.0 Medium2026-02-25
CVE-2026-3147 libvips csvload.c vips_foreign_load_csv_build heap-based overflow — libvips 5.3 Medium2026-02-25
CVE-2026-26284 ImageMagick has heap overflow in pcd decoder that leads to out of bounds read. — ImageMagick 6.5 Medium2026-02-24
CVE-2026-25897 ImageMagick has heap overflow in sun decoder on 32-bit systems that can result in out of bounds write — ImageMagick 6.5 Medium2026-02-24
CVE-2026-25794 ImageMagick has heap-buffer-overflow via signed integer overflow in `WriteUHDRImage` when writing UHDR images with large dimensions — ImageMagick 8.2 High2026-02-24

Vulnerabilities classified as CWE-122 (堆缓冲区溢出) represent 1863 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.