CWE-122— Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().— MITRE CWE catalog
3,755 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-122page 13 of 76
- CVE-2026-0200HIGHCVSS 8.8EG 8.82026-09-15
In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-91964HIGHCVSS 8.8EG 8.82026-09-15
FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the ov…
- CVE-2026-87430HIGHCVSS 8.8EG 8.82026-09-09
Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-87579HIGHCVSS 8.8EG 8.82026-09-09
Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-49882HIGHCVSS 8.8EG 8.82026-09-08
In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for explo…
- CVE-2026-28618HIGHCVSS 8.8EG 8.82026-09-08
In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-83992HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
- CVE-2026-77906HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
- CVE-2026-81952HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-81955HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
- CVE-2026-81352HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
- CVE-2026-80085HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-78526HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-78521HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-77481HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-78512HIGHCVSS 8.8EG 8.82026-09-08
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-78456HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-78442HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network.
- CVE-2026-77486HIGHCVSS 8.8EG 8.82026-09-08
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network.
- CVE-2026-71328HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
- CVE-2026-73016HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
- CVE-2026-73013HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
- CVE-2026-73023HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
- CVE-2026-73012HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Windows Management Services allows an authorized attacker to elevate privileges over a network.
- CVE-2026-73018HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
- CVE-2026-72973HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-72972HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-70203HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.
- CVE-2026-69439HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69629HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
- CVE-2026-69442HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
- CVE-2026-69601HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
- CVE-2026-69334HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.
- CVE-2026-69291HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.
- CVE-2026-72960HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.
- CVE-2026-72959HIGHCVSS 8.8EG 8.82026-09-08
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
- CVE-2026-72933HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network.
- CVE-2026-69625HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges over a network.
- CVE-2026-69547HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.
- CVE-2026-69512HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to elevate privileges over a network.
- CVE-2026-69511HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
- CVE-2026-69434HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Windows URL Moniker allows an unauthorized attacker to execute code over a network.
- CVE-2026-69386HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
- CVE-2026-69360HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-68828HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- CVE-2026-68775HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-67642HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-67639HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-67638HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-67388HIGHCVSS 8.8EG 8.82026-09-08
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
Map vulnerabilities like CWE-122 to your infrastructure
EchelonGraph correlates every CVE — across CWE-122 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →