CWE-122— Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().— MITRE CWE catalog
3,271 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-122page 30 of 66
- CVE-2026-75144HIGHCVSS 7.8EG 7.82026-08-19
FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packeti…
- CVE-2026-75141HIGHCVSS 7.8EG 7.82026-08-19
FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a…
- CVE-2026-49430HIGHCVSS 7.8EG 7.82026-08-19
The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive"…
- CVE-2026-49429HIGHCVSS 7.8EG 7.82026-08-19
The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with…
- CVE-2026-68812HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-68805HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-68804HIGHCVSS 7.8EG 7.82026-08-11
Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-68801HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-68798HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-65799HIGHCVSS 7.8EG 7.82026-08-11
Integer overflow or wraparound in Windows DNS allows an authorized attacker to elevate privileges locally.
- CVE-2026-65790HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
- CVE-2026-65774HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-64920HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.
- CVE-2026-64915HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-64914HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.
- CVE-2026-64908HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.
- CVE-2026-64911HIGHCVSS 7.8EG 7.82026-08-11
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-64909HIGHCVSS 7.8EG 7.82026-08-11
Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-64906HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.
- CVE-2026-64903HIGHCVSS 7.8EG 7.82026-08-11
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-64898HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-63533HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-63532HIGHCVSS 7.8EG 7.82026-08-11
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-62886HIGHCVSS 7.8EG 7.82026-08-11
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
- CVE-2026-62885HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
- CVE-2026-62871HIGHCVSS 7.8EG 7.82026-08-11
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
- CVE-2026-62811HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
- CVE-2026-62799HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally.
- CVE-2026-62770HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows Shell allows an authorized attacker to elevate privileges locally.
- CVE-2026-62771HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
- CVE-2026-62752HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally.
- CVE-2026-62741HIGHCVSS 7.8EG 7.82026-08-11
Integer underflow (wrap or wraparound) in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
- CVE-2026-62736HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges locally.
- CVE-2026-62732HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-62717HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
- CVE-2026-62710HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-62700HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
- CVE-2026-61926HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.
- CVE-2026-61355HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-61359HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- CVE-2026-58651HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-70347HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-70345HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-70330HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.
- CVE-2026-70304HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.
- CVE-2026-68815HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-68807HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-68800HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-68796HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-68794HIGHCVSS 7.8EG 7.82026-08-11
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Map vulnerabilities like CWE-122 to your infrastructure
EchelonGraph correlates every CVE — across CWE-122 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →