CWE-122— Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().— MITRE CWE catalog
3,758 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-122page 31 of 76
- CVE-2026-102205HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
- CVE-2026-96929HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2026-96916HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
- CVE-2026-96843HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.
- CVE-2026-88093HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
- CVE-2026-70143HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Network File System allows an authorized attacker to execute code locally.
- CVE-2026-70112HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code locally.
- CVE-2026-70054HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally.
- CVE-2026-88193HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized attacker to elevate privileges locally.
- CVE-2026-88147HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.
- CVE-2026-88118HIGHCVSS 7.8EG 7.82026-10-13
Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
- CVE-2026-88128HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
- CVE-2026-87699HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.
- CVE-2026-83931HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
- CVE-2026-85908HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
- CVE-2026-85902HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
- CVE-2026-85901HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
- CVE-2026-83903HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
- CVE-2026-83881HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.
- CVE-2026-83863HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
- CVE-2026-83861HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.
- CVE-2026-83850HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
- CVE-2026-83830HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-83829HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
- CVE-2026-83783HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
- CVE-2026-83757HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
- CVE-2026-83709HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows NTLM allows an authorized attacker to elevate privileges locally.
- CVE-2026-83698HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-83640HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
- CVE-2026-83639HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-83638HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.
- CVE-2026-83588HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.
- CVE-2026-83579HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.
- CVE-2026-83513HIGHCVSS 7.8EG 7.82026-10-13
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
- CVE-2026-83514HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.
- CVE-2026-78459HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to elevate privileges locally.
- CVE-2026-69471HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-97794HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
- CVE-2026-97009HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-97001HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-96996HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-96920HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-96856HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
- CVE-2026-96318HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Resume allows an authorized attacker to elevate privileges locally.
- CVE-2026-96312HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2026-96217HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
- CVE-2026-70220HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-70109HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.
- CVE-2026-70092HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.
- CVE-2026-70131HIGHCVSS 7.8EG 7.82026-10-13
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally.
Map vulnerabilities like CWE-122 to your infrastructure
EchelonGraph correlates every CVE — across CWE-122 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →