CWE-122— Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().— MITRE CWE catalog
3,752 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-122page 11 of 76
- CVE-2026-108430HIGHCVSS 8.8EG 8.82026-10-15
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-108429HIGHCVSS 8.8EG 8.82026-10-15
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-108428HIGHCVSS 8.8EG 8.82026-10-15
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-108427HIGHCVSS 8.8EG 8.82026-10-15
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-108426HIGHCVSS 8.8EG 8.82026-10-15
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-63626HIGHCVSS 8.8EG 8.82026-10-14
Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCP…
- CVE-2026-102015HIGHCVSS 8.8EG 8.82026-10-14
A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EA…
- CVE-2026-103994HIGHCVSS 8.8EG 8.82026-10-14
A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code exe…
- CVE-2026-110155HIGHCVSS 8.8EG 8.82026-10-13
Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-110166HIGHCVSS 8.8EG 8.82026-10-13
Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-94512HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-100220HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.
- CVE-2026-100210HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97768HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97763HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97741HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97004HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97757HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97777HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97773HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97769HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97756HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97007HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97748HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-96952HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
- CVE-2026-96202HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
- CVE-2026-96917HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.
- CVE-2026-96914HIGHCVSS 8.8EG 8.82026-10-13
Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
- CVE-2026-70343HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network.
- CVE-2026-88186HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-88163HIGHCVSS 8.8EG 8.82026-10-13
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-88142HIGHCVSS 8.8EG 8.82026-10-13
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
- CVE-2026-85905HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally.
- CVE-2026-83874HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code over a network.
- CVE-2026-83777HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network.
- CVE-2026-83778HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network.
- CVE-2026-83725HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.
- CVE-2026-83716HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
- CVE-2026-69326HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
- CVE-2026-77496HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
- CVE-2026-77902HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-70258HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
- CVE-2026-69985HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.
- CVE-2026-97739HIGHCVSS 8.8EG 8.82026-10-13
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97765HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97780HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97754HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97758HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97776HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97751HIGHCVSS 8.8EG 8.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Map vulnerabilities like CWE-122 to your infrastructure
EchelonGraph correlates every CVE — across CWE-122 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →