CWE-122— Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().— MITRE CWE catalog
3,757 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-122page 18 of 76
- CVE-2025-49672HIGHCVSS 8.8EG 8.82025-07-08
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
- CVE-2025-49669HIGHCVSS 8.8EG 8.82025-07-08
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
- CVE-2025-49668HIGHCVSS 8.8EG 8.82025-07-08
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
- CVE-2025-49663HIGHCVSS 8.8EG 8.82025-07-08
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
- CVE-2025-49657HIGHCVSS 8.8EG 8.82025-07-08
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
- CVE-2025-48824HIGHCVSS 8.8EG 8.82025-07-08
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
- CVE-2025-47998HIGHCVSS 8.8EG 8.82025-07-08
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
- CVE-2025-5830HIGHCVSS 8.8EG 8.82025-06-25
Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel Max…
- CVE-2025-33066HIGHCVSS 8.8EG 8.82025-06-10
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
- CVE-2025-33064HIGHCVSS 8.8EG 8.82025-06-10
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
- CVE-2025-5750HIGHCVSS 8.8EG 8.82025-06-06
WOLFBOX Level 2 EV Charger tuya_svc_devos_activate_result_parse Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WOL…
- CVE-2025-1051HIGHCVSS 8.8EG 8.82025-06-02
Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this…
- CVE-2025-44905HIGHCVSS 8.8EG 8.82025-05-30
hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function.
- CVE-2025-44904HIGHCVSS 8.8EG 8.82025-05-30
hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function.
- CVE-2025-29967HIGHCVSS 8.8EG 8.82025-05-13
Heap-based buffer overflow in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
- CVE-2025-29966HIGHCVSS 8.8EG 8.82025-05-13
Heap-based buffer overflow in Windows Remote Desktop allows an unauthorized attacker to execute code over a network.
- CVE-2025-29964HIGHCVSS 8.8EG 8.82025-05-13
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.
- CVE-2025-29963HIGHCVSS 8.8EG 8.82025-05-13
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.
- CVE-2025-29962HIGHCVSS 8.8EG 8.82025-05-13
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.
- CVE-2025-4355HIGHCVSS 8.8EG 8.82025-05-06
A vulnerability was found in Tenda DAP-1520 1.10B04_BETA02. It has been classified as critical. This affects the function set_ws_action of the file /dws/api/. The manipulation leads to heap-based buffer overflow. It is possible to initiate…
- CVE-2025-4096HIGHCVSS 8.8EG 8.82025-05-05
Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2025-1049HIGHCVSS 8.8EG 8.82025-04-23
Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this…
- CVE-2025-3619HIGHCVSS 8.8EG 8.82025-04-16
Heap buffer overflow in Codecs in Google Chrome on Windows prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
- CVE-2025-27477HIGHCVSS 8.8EG 8.82025-04-08
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
- CVE-2025-21222HIGHCVSS 8.8EG 8.82025-04-08
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
- CVE-2025-21221HIGHCVSS 8.8EG 8.82025-04-08
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
- CVE-2025-21205HIGHCVSS 8.8EG 8.82025-04-08
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
- CVE-2025-24056HIGHCVSS 8.8EG 8.82025-03-11
Heap-based buffer overflow in Windows Telephony Server allows an unauthorized attacker to execute code over a network.
- CVE-2025-24051HIGHCVSS 8.8EG 8.82025-03-11
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
- CVE-2025-1538HIGHCVSS 8.8EG 8.82025-02-21
A vulnerability classified as critical was found in D-Link DAP-1320 1.00. Affected by this vulnerability is the function set_ws_action of the file /dws/api/. The manipulation leads to heap-based buffer overflow. The attack can be launched …
- CVE-2025-1426HIGHCVSS 8.8EG 8.82025-02-19
Heap buffer overflow in GPU in Google Chrome on Android prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2025-0999HIGHCVSS 8.8EG 8.82025-02-19
Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2025-1052HIGHCVSS 8.8EG 8.82025-02-11
Mintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mintty. User interaction is required to exploit th…
- CVE-2025-0903HIGHCVSS 8.8EG 8.82025-02-11
PDF-XChange Editor RTF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is r…
- CVE-2025-21410HIGHCVSS 8.8EG 8.82025-02-11
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
- CVE-2025-21407HIGHCVSS 8.8EG 8.82025-02-11
Windows Telephony Service Remote Code Execution Vulnerability
- CVE-2025-21371HIGHCVSS 8.8EG 8.82025-02-11
Windows Telephony Service Remote Code Execution Vulnerability
- CVE-2025-21369HIGHCVSS 8.8EG 8.82025-02-11
Microsoft Digest Authentication Remote Code Execution Vulnerability
- CVE-2025-21368HIGHCVSS 8.8EG 8.82025-02-11
Microsoft Digest Authentication Remote Code Execution Vulnerability
- CVE-2025-21208HIGHCVSS 8.8EG 8.82025-02-11
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
- CVE-2025-21200HIGHCVSS 8.8EG 8.82025-02-11
Windows Telephony Service Remote Code Execution Vulnerability
- CVE-2025-21190HIGHCVSS 8.8EG 8.82025-02-11
Windows Telephony Service Remote Code Execution Vulnerability
- CVE-2019-15690HIGHCVSS 8.8EG 8.82025-01-24
LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in re…
- CVE-2023-50739HIGHCVSS 8.8EG 8.82025-01-18
A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code.
- CVE-2025-0434HIGHCVSS 8.8EG 8.82025-01-15
Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2025-21417HIGHCVSS 8.8EG 8.82025-01-14
Windows Telephony Service Remote Code Execution Vulnerability
- CVE-2025-21413HIGHCVSS 8.8EG 8.82025-01-14
Windows Telephony Service Remote Code Execution Vulnerability
- CVE-2025-21411HIGHCVSS 8.8EG 8.82025-01-14
Windows Telephony Service Remote Code Execution Vulnerability
- CVE-2025-21409HIGHCVSS 8.8EG 8.82025-01-14
Windows Telephony Service Remote Code Execution Vulnerability
- CVE-2025-21339HIGHCVSS 8.8EG 8.82025-01-14
Windows Telephony Service Remote Code Execution Vulnerability
Map vulnerabilities like CWE-122 to your infrastructure
EchelonGraph correlates every CVE — across CWE-122 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →