Heap-based Buffer Overflow
CWE-122
The product writes past the end of a buffer that was allocated on the heap.
We track 1,418 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 21 have been exploited in real attacks.
How this weakness is prevented
- Pre-design: Use a language or compiler that performs automatic bounds checking.
- Architecture and Design: Use an abstraction library to abstract away risky APIs. Not a complete solution.
- Operation Build and Compilation: Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.
- Implementation: Implement and perform bounds checking on input.
- Implementation: Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
Latest Heap-based Buffer Overflow vulnerabilities
- 7.5 High severity
Junos OS: Heap-based Buffer Overflow
An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine (PFE) of Juniper Networks Junos OS allows a network-based unauthenticated attacker to flood the device with traffic leading to a Denial of S
- 9.8 Critical severity
Samsung Mobile Devices: Out-of-bounds Write
Heap-based buffer overflow vulnerability in parser_ipma function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attackers.
- 9.8 Critical severity
Samsung Mobile Devices: Out-of-bounds Write
Heap-based buffer overflow vulnerability in sheifd_get_info_image function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker.
- 9.8 Critical severity
Samsung Mobile Devices: Out-of-bounds Write
Heap-based buffer overflow vulnerability in parser_single_iref function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker.
- 9.8 Critical severity
Samsung Mobile Devices: Out-of-bounds Write
Heap-based buffer overflow vulnerability in parser_infe function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker.
- 9.8 Critical severity
Samsung Mobile Devices: Out-of-bounds Write
Heap-based buffer overflow vulnerability in parser_iloc function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker.
- 9.8 Critical severity
Samsung Mobile Devices: Out-of-bounds Write
Heap-based buffer overflow vulnerability in sheifd_create function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attackers.
- 9.8 Critical severity
mruby/mruby: Out-of-bounds Write
heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
- 9.8 Critical severity
strukturag/libde265: Out-of-bounds Write
Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix is established in commit 8e89fe0e175d2870c39486fdd09250b230ec10b8 but does not yet belong to an official release.
- 7.8 High severity
radareorg/radare2: Out-of-bounds Write
Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6. If address sanitizer is disabled during the compiling, the program should executes into the `r_str_ncpy` function. Therefore I think it is very likely
- 7.5 High severity
yajl-ruby: Heap-based Buffer Overflow
yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at
- 9.3 High severity
After Effects: Out-of-bounds Write
Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by an Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user inte
- 7.8 High severity
MariaDB: Heap-based Buffer Overflow
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The s
- 6.8 Medium severity
Adobe Acrobat and Reader Heap-based Buffer Overflow Exploited
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve
- 9.6 Critical severity
Google Chrome for Android UI Heap Buffer Overflow Exploited
Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- 9.8 Critical severity
WhatsApp VOIP Stack Buffer Overflow Exploited
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v
- 9.8 Critical severity
Adobe Flash Player Heap-Based Buffer Overflow Exploited
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild
- 9.3 High severity
Adobe Acrobat and Reader Heap-Based Buffer Overflow Exploited
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NO