CWE-122 Heap-based Buffer Overflow
variantA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (4862)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-94127US | critical9.8OT kritisch | KEV | ||
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is o… | ||||
| CVE-2026-85103US | —OT kritisch | — | ||
A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and… | ||||
| CVE-2026-85880US | high7.8OT kritisch | KEV | ||
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-53362US | —OT kritisch | KEV | ||
In the Linux kernel, the following vulnerability has been resolved:
ipv6: account for fraggap on the paged allocation path
In __ip6_append_data(), when the paged-allocation branc… | ||||
| CVE-2025-25249US | critical9.8OT kritisch | KEV | ||
A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS… | ||||
| CVE-2025-24993US | —OT kritisch | KEV | ||
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-24985US | —OT kritisch | KEV | ||
Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-21418US | —OT kritisch | KEV | ||
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | ||||
| CVE-2025-21333US | —OT kritisch | KEV | ||
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | ||||
| CVE-2024-49138US | —OT kritisch | KEV | ||
Windows Common Log File System Driver Elevation of Privilege Vulnerability | ||||
| CVE-2024-38812US | critical9.8OT kritisch | KEV | ||
The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vul… | ||||
| CVE-2024-37079US | critical9.8OT kritisch | KEV | ||
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnera… | ||||
| CVE-2024-30051US | —OT kritisch | KEV | ||
Windows DWM Core Library Elevation of Privilege Vulnerability | ||||
| CVE-2023-7024US | high8.8OT kritisch | KEV | ||
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security… | ||||
| CVE-2023-36036US | high7.8OT kritisch | KEV | ||
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | ||||
| CVE-2023-4911US | high7.8OT kritisch | KEV | ||
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to us… | ||||
| CVE-2023-5217US | high8.8OT kritisch | KEV | ||
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a cra… | ||||
| CVE-2023-4863US | high8.8OT kritisch | KEV | ||
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML pag… | ||||
| CVE-2023-27997US | critical9.8OT kritisch | KEV | ||
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy… | ||||
| CVE-2023-28252US | —OT kritisch | KEV | ||
Windows Common Log File System Driver Elevation of Privilege Vulnerability | ||||
03
Angriffsmuster (1)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan