CWE-122— Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().— MITRE CWE catalog
3,271 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-122page 32 of 66
- CVE-2026-56650HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges locally.
- CVE-2026-54124HIGHCVSS 7.8EG 7.82026-07-14
Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally.
- CVE-2026-56182HIGHCVSS 7.8EG 7.82026-07-14
Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.
- CVE-2026-56175HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
- CVE-2026-56156HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-55947HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-55120HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
- CVE-2026-55123HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
- CVE-2026-55133HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code locally.
- CVE-2026-55043HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
- CVE-2026-55130HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-55140HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-55056HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-55131HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-55053HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-55137HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-55037HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-55129HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-55127HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-55041HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-55033HIGHCVSS 7.8EG 7.82026-07-14
Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-55049HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-55039HIGHCVSS 7.8EG 7.82026-07-14
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-55029HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-55048HIGHCVSS 7.8EG 7.82026-07-14
Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-55125HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-55017HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-50301HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-50679HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
- CVE-2026-54115HIGHCVSS 7.8EG 7.82026-07-14
Integer overflow or wraparound in Windows Active Directory allows an authorized attacker to elevate privileges locally.
- CVE-2026-50655HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.
- CVE-2026-50494HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
- CVE-2026-50499HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
- CVE-2026-50484HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2026-50482HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
- CVE-2026-50480HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows Web Proxy Auto-Discovery Protocol (WPAD) allows an authorized attacker to elevate privileges locally.
- CVE-2026-50362HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code locally.
- CVE-2026-50417HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
- CVE-2026-50461HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
- CVE-2026-50471HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
- CVE-2026-50448HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
- CVE-2026-50336HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.
- CVE-2026-50375HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows DirectX allows an authorized attacker to elevate privileges locally.
- CVE-2026-50347HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows Data dll allows an unauthorized attacker to execute code locally.
- CVE-2026-50407HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
- CVE-2026-50327HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.
- CVE-2026-50313HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
- CVE-2026-50309HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
- CVE-2026-50386HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
- CVE-2026-50363HIGHCVSS 7.8EG 7.82026-07-14
Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
Map vulnerabilities like CWE-122 to your infrastructure
EchelonGraph correlates every CVE — across CWE-122 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →