CWE-122
AllowedHeap-based Buffer Overflow
Abstraction: Variant · Status: Draft
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
6212 vulnerabilities reference this CWE, most recent first.
GHSA-RWX9-M3PJ-2MV2
Vulnerability from github – Published: 2026-06-03 18:33 – Updated: 2026-10-19 21:34In the Linux kernel, the following vulnerability has been resolved:
pstore/ram: fix buffer overflow in persistent_ram_save_old()
persistent_ram_save_old() can be called multiple times for the same persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_get_next_prz for PSTORE_TYPE_DMESG records).
Currently, the function only allocates prz->old_log when it is NULL, but it unconditionally updates prz->old_log_size to the current buffer size and then performs memcpy_fromio() using this new size. If the buffer size has grown since the first allocation (which can happen across different kernel boot cycles), this leads to:
- A heap buffer overflow (OOB write) in the memcpy_fromio() calls
- A subsequent OOB read when ramoops_pstore_read() accesses the buffer using the incorrect (larger) old_log_size
The KASAN splat would look similar to: BUG: KASAN: slab-out-of-bounds in ramoops_pstore_read+0x... Read of size N at addr ... by task ...
The conditions are likely extremely hard to hit:
- Crash with a ramoops write of less-than-record-max-size bytes.
- Reboot: ramoops registers, pstore_get_records(0) reads old crash, allocates old_log with size X
- Crash handler registered, timer started (if pstore_update_ms >= 0)
- Oops happens (non-fatal, system continues)
- pstore_dump() writes oops via ramoops_pstore_write() size Y (>X)
- pstore_new_entry = 1, pstore_timer_kick() called
- System continues running (not a panic oops)
- Timer fires after pstore_update_ms milliseconds
- pstore_timefunc() → schedule_work() → pstore_dowork() → pstore_get_records(1)
- ramoops_get_next_prz() → persistent_ram_save_old()
- buffer_size() returns Y, but old_log is X bytes
- Y > X: memcpy_fromio() overflows heap
Requirements: - a prior crash record exists that did not fill the record size (almost impossible since the crash handler writes as much as it can possibly fit into the record, capped by max record size and the kmsg buffer almost always exceeds the max record size) - pstore_update_ms >= 0 (disabled by default) - Non-fatal oops (system survives)
Free and reallocate the buffer when the new size differs from the previously allocated size. This ensures old_log always has sufficient space for the data being copied.
{
"affected": [],
"aliases": [
"CVE-2026-46253"
],
"database_specific": {
"cwe_ids": [
"CWE-122",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-03T18:16:26Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore/ram: fix buffer overflow in persistent_ram_save_old()\n\npersistent_ram_save_old() can be called multiple times for the same\npersistent_ram_zone (e.g., via ramoops_pstore_read -\u003e ramoops_get_next_prz\nfor PSTORE_TYPE_DMESG records).\n\nCurrently, the function only allocates prz-\u003eold_log when it is NULL,\nbut it unconditionally updates prz-\u003eold_log_size to the current buffer\nsize and then performs memcpy_fromio() using this new size. If the\nbuffer size has grown since the first allocation (which can happen\nacross different kernel boot cycles), this leads to:\n\n1. A heap buffer overflow (OOB write) in the memcpy_fromio() calls\n2. A subsequent OOB read when ramoops_pstore_read() accesses the buffer\n using the incorrect (larger) old_log_size\n\nThe KASAN splat would look similar to:\n BUG: KASAN: slab-out-of-bounds in ramoops_pstore_read+0x...\n Read of size N at addr ... by task ...\n\nThe conditions are likely extremely hard to hit:\n\n 0. Crash with a ramoops write of less-than-record-max-size bytes.\n 1. Reboot: ramoops registers, pstore_get_records(0) reads old crash,\n allocates old_log with size X\n 2. Crash handler registered, timer started (if pstore_update_ms \u003e= 0)\n 3. Oops happens (non-fatal, system continues)\n 4. pstore_dump() writes oops via ramoops_pstore_write() size Y (\u003eX)\n 5. pstore_new_entry = 1, pstore_timer_kick() called\n 6. System continues running (not a panic oops)\n 7. Timer fires after pstore_update_ms milliseconds\n 8. pstore_timefunc() \u2192 schedule_work() \u2192 pstore_dowork() \u2192 pstore_get_records(1)\n 9. ramoops_get_next_prz() \u2192 persistent_ram_save_old()\n 10. buffer_size() returns Y, but old_log is X bytes\n 11. Y \u003e X: memcpy_fromio() overflows heap\n\n Requirements:\n - a prior crash record exists that did not fill the record size\n (almost impossible since the crash handler writes as much as it\n can possibly fit into the record, capped by max record size and\n the kmsg buffer almost always exceeds the max record size)\n - pstore_update_ms \u003e= 0 (disabled by default)\n - Non-fatal oops (system survives)\n\nFree and reallocate the buffer when the new size differs from the\npreviously allocated size. This ensures old_log always has sufficient\nspace for the data being copied.",
"id": "GHSA-rwx9-m3pj-2mv2",
"modified": "2026-10-19T21:34:41Z",
"published": "2026-06-03T18:33:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46253"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/06d2c8bd108cea503f6f6e13e47495ed1085275f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2fa9a047c6a50ec80c3890dd623b85e237f0d1fd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4f73486ca822305c1cf5b8ebc0b53a6ab3801a81"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5669645c052f235726a85f443769b6fc02f66762"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/58bda5a1d1ee98254383ef34f76b2c35140513ea"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7cfe964e61c0ab667abd5f5b68e0acbf783efa4f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9a6fc69a570c0780834246d52c856cc3dbc2605f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cff0ef043e16feb5a02307c8f9d0117a96c5587c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RX3J-28Q8-XW3M
Vulnerability from github – Published: 2026-07-03 21:31 – Updated: 2026-10-12 03:32A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory.
{
"affected": [],
"aliases": [
"CVE-2026-58379"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-03T19:16:37Z",
"severity": "HIGH"
},
"details": "A flaw was found in GIMP\u0027s Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory.",
"id": "GHSA-rx3j-28q8-xw3m",
"modified": "2026-10-12T03:32:55Z",
"published": "2026-07-03T21:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58379"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:38496"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:73768"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:80509"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-58379"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495997"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/gimp/-/commit/b630f167"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/gimp/-/issues/16205"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RX79-RGX5-5GQX
Vulnerability from github – Published: 2022-05-24 19:18 – Updated: 2025-08-15 21:31Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
{
"affected": [],
"aliases": [
"CVE-2021-34583"
],
"database_specific": {
"cwe_ids": [
"CWE-122",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-26T10:15:00Z",
"severity": "HIGH"
},
"details": "Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.",
"id": "GHSA-rx79-rgx5-5gqx",
"modified": "2025-08-15T21:31:13Z",
"published": "2022-05-24T19:18:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34583"
},
{
"type": "WEB",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RX9W-C6JV-2GRG
Vulnerability from github – Published: 2025-01-24 18:31 – Updated: 2025-01-24 18:31LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.
{
"affected": [],
"aliases": [
"CVE-2019-15690"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-24T18:15:27Z",
"severity": "HIGH"
},
"details": "LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.",
"id": "GHSA-rx9w-c6jv-2grg",
"modified": "2025-01-24T18:31:13Z",
"published": "2025-01-24T18:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15690"
},
{
"type": "WEB",
"url": "https://ics-cert.kaspersky.com/vulnerabilities/klcert-20-009-remote-code-execution-on-libvnc-version-prior-to-0-9-12"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RXJX-CQF4-362V
Vulnerability from github – Published: 2026-09-08 18:32 – Updated: 2026-09-08 18:32Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
{
"affected": [],
"aliases": [
"CVE-2026-69442"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T18:19:08Z",
"severity": "HIGH"
},
"details": "Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.",
"id": "GHSA-rxjx-cqf4-362v",
"modified": "2026-09-08T18:32:36Z",
"published": "2026-09-08T18:32:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69442"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69442"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RXP8-2PPX-X6FM
Vulnerability from github – Published: 2026-09-08 18:32 – Updated: 2026-09-08 18:32Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.
{
"affected": [],
"aliases": [
"CVE-2026-68889"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T18:18:36Z",
"severity": "HIGH"
},
"details": "Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.",
"id": "GHSA-rxp8-2ppx-x6fm",
"modified": "2026-09-08T18:32:17Z",
"published": "2026-09-08T18:32:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68889"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68889"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RXPH-59R7-6V5X
Vulnerability from github – Published: 2026-10-19 18:32 – Updated: 2026-10-19 18:32IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.
{
"affected": [],
"aliases": [
"CVE-2026-10574"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-19T17:17:01Z",
"severity": "HIGH"
},
"details": "IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.",
"id": "GHSA-rxph-59r7-6v5x",
"modified": "2026-10-19T18:32:14Z",
"published": "2026-10-19T18:32:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10574"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7292667"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RXVF-8H4J-77FW
Vulnerability from github – Published: 2025-07-09 00:30 – Updated: 2025-07-09 00:30Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2025-47123"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-08T23:15:24Z",
"severity": "HIGH"
},
"details": "Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-rxvf-8h4j-77fw",
"modified": "2025-07-09T00:30:33Z",
"published": "2025-07-09T00:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47123"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/framemaker/apsb25-66.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RXWM-PW9Q-MFXP
Vulnerability from github – Published: 2025-01-14 18:32 – Updated: 2025-01-14 18:32Microsoft Access Remote Code Execution Vulnerability
{
"affected": [],
"aliases": [
"CVE-2025-21395"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-14T18:16:04Z",
"severity": "HIGH"
},
"details": "Microsoft Access Remote Code Execution Vulnerability",
"id": "GHSA-rxwm-pw9q-mfxp",
"modified": "2025-01-14T18:32:06Z",
"published": "2025-01-14T18:32:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21395"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21395"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V28H-8438-GHJ5
Vulnerability from github – Published: 2026-09-29 12:31 – Updated: 2026-09-29 12:31SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
{
"affected": [],
"aliases": [
"CVE-2026-95387"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-29T10:17:14Z",
"severity": "HIGH"
},
"details": "SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service",
"id": "GHSA-v28h-8438-ghj5",
"modified": "2026-09-29T12:31:30Z",
"published": "2026-09-29T12:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95387"
},
{
"type": "WEB",
"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21487"
},
{
"type": "WEB",
"url": "https://www.wireshark.org/security/wnpa-sec-2026-97.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Pre-design: Use a language or compiler that performs automatic bounds checking.
Mitigation
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation MIT-10
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation MIT-11
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Mitigation
Implement and perform bounds checking on input.
Mitigation
Strategy: Libraries or Frameworks
Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
Mitigation
Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth.
CAPEC-92: Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.