Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CWE-122 (堆缓冲区溢出) — Vulnerability Class 1859

1859 vulnerabilities classified as CWE-122 (堆缓冲区溢出). AI Chinese analysis included.

CWE-122 represents a critical memory safety weakness where an application writes data beyond the allocated boundaries of a heap-allocated buffer, typically created via functions like malloc. This vulnerability arises when developers fail to validate input lengths or perform insufficient bounds checking before copying data into dynamically allocated memory regions. Attackers exploit this flaw by crafting malicious inputs that exceed buffer limits, allowing them to overwrite adjacent heap metadata or control structures. Such overwrites can corrupt the heap manager’s internal state, leading to application crashes, data leakage, or arbitrary code execution by hijacking control flow. To prevent heap-based buffer overflows, developers must rigorously validate all input sizes against buffer capacities, utilize safe string handling libraries that enforce length limits, and employ modern memory-safe programming languages that automatically manage memory boundaries, thereby eliminating manual pointer arithmetic errors.

MITRE CWE Description
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Common Consequences (3)
AvailabilityDoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Integrity, Confidentiality, Availability, Access ControlExecute Unauthorized Code or Commands, Bypass Protection Mechanism, Modify Memory
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. Besides important user data, heap-based overflows can be used to overwrite function pointers that may be living in memory, pointing it to the attacker's code. Eve…
Integrity, Confidentiality, Availability, Access Control, OtherExecute Unauthorized Code or Commands, Bypass Protection Mechanism, Other
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
Mitigations (5)
Pre-design: Use a language or compiler that performs automatic bounds checking.
Architecture and DesignUse an abstraction library to abstract away risky APIs. Not a complete solution.
Operation, Build and CompilationUse automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses…
Effectiveness: Defense in Depth
Operation, Build and CompilationRun or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code. Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported…
Effectiveness: Defense in Depth
ImplementationImplement and perform bounds checking on input.
Examples (2)
While buffer overflow examples can be rather complex, it is possible to have very simple, yet still exploitable, heap-based buffer overflows:
#define BUFSIZE 256 int main(int argc, char **argv) { char *buf; buf = (char *)malloc(sizeof(char)*BUFSIZE); strcpy(buf, argv[1]); }
Bad · C
This example applies an encoding procedure to an input string and stores it into a buffer.
char * copy_input(char *user_supplied_string){ int i, dst_index; char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE); if ( MAX_SIZE <= strlen(user_supplied_string) ){ die("user string too long, die evil hacker!"); } dst_index = 0; for ( i = 0; i < strlen(user_supplied_string); i++ ){ if( '&' == user_supplied_string[i] ){ dst_buf[dst_index++] = '&'; dst_buf[dst_index++] = 'a'; dst_buf[dst_index++] = 'm'; dst_buf[dst_index++] = 'p'; dst_buf[dst_index++] = ';'; } else if ('<' == user_supplied_string[i] ){ /* encode to &lt; */ } else dst_buf[dst_index++] = user_supplied_string[i]; } return ds
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2019-10951 Delta Electronics Delta Industrial Automation CNCSoft ScreenEditor 缓冲区错误漏洞 — Delta Industrial Automation CNCSoft 7.8 -2019-04-17
CVE-2014-9187 Honeywell International Experion PKS 缓冲区错误漏洞 — Experion PKS 9.8 -2019-03-25
CVE-2015-6457 Moxa SoftCMS 缓冲区错误漏洞 — SoftCMS 8.8 -2019-03-21
CVE-2019-8271 UltraVNC 缓冲区错误漏洞 — UltraVNC 9.8 -2019-03-09
CVE-2019-8273 UltraVNC 缓冲区错误漏洞 — UltraVNC 9.8 -2019-03-09
CVE-2019-8274 UltraVNC 缓冲区错误漏洞 — UltraVNC 9.8 -2019-03-09
CVE-2019-5019 Antenna House Rainbow PDF Office Server Document Converter 缓冲区错误漏洞 — Antenna House 8.4 -2019-03-07
CVE-2019-8258 UltraVNC 缓冲区错误漏洞 — UltraVNC 9.8 -2019-03-05
CVE-2019-8262 UltraVNC 缓冲区错误漏洞 — UltraVNC 9.8 -2019-03-05
CVE-2019-6539 WECON Technologies LeviStudioU 缓冲区错误漏洞 — WECON LeviStudioU 7.8 -2019-02-13
CVE-2018-8793 rdesktop 缓冲区错误漏洞 — rdesktop 9.8 -2019-02-05
CVE-2018-8797 rdesktop 缓冲区错误漏洞 — rdesktop 9.8 -2019-02-05
CVE-2018-8800 rdesktop 缓冲区错误漏洞 — rdesktop 9.8 -2019-02-05
CVE-2018-18981 Rockwell Automation FactoryTalk Services Platform 安全漏洞 — Rockwell Automation FactoryTalk Services Platform v2.90 and earlier 7.5 -2019-01-24
CVE-2018-6345 Facebook HHVM 缓冲区错误漏洞 — HHVM 9.1 -2019-01-15
CVE-2018-6344 Facebook WhatsApp 缓冲区错误漏洞 — WhatsApp for Android 7.5 -2018-12-31
CVE-2018-11457 多款Siemens产品缓冲区错误漏洞 — SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8 8.1 -2018-12-12
CVE-2016-2123 Samba 缓冲区错误漏洞 — samba 8.8 -2018-11-01
CVE-2018-14653 Red Hat Gluster 缓冲区错误漏洞 — glusterfs 8.8 -2018-10-31
CVE-2017-7908 GE Communicator Gigasoft 缓冲区错误漏洞 — GE Communicator 7.6 -2018-10-02
CVE-2018-14794 Fuji Electric Alpha5 Smart Loader 缓冲区错误漏洞 — Alpha5 Smart Loader 9.8 -2018-10-01
CVE-2018-14813 Fuji Electric V-Server VPR 缓冲区错误漏洞 — V-Server 9.8 -2018-09-26
CVE-2018-10606 WECON LeviStudioU 缓冲区错误漏洞 — LeviStudioU 8.8 -2018-09-26
CVE-2018-14821 Rockwell Automation RSLinx Classic 安全漏洞 — RSLinx Classic 7.5 -2018-09-20
CVE-2018-10893 Red Hat spice-client 安全漏洞 — spice-client 9.8 -2018-09-11
CVE-2016-8654 JasPer JPC codec 缓冲区错误漏洞 — jasper 7.8 -2018-08-01
CVE-2018-14290 Foxit Reader和PhantomPDF 缓冲区错误漏洞 — Foxit Reader 8.8 -2018-07-31
CVE-2016-9603 QEMU 缓冲区错误漏洞 — Qemu: 9.9 -2018-07-27
CVE-2018-1056 advancecomp 缓冲区错误漏洞 — advancecomp: 7.8 -2018-07-27
CVE-2018-3857 ACD Systems Canvas Draw 缓冲区错误漏洞 — Canvas Draw 7.8 -2018-07-19

Vulnerabilities classified as CWE-122 (堆缓冲区溢出) represent 1859 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.