CWE-122 · Heap-based Buffer Overflow (page 11)
Page 11 of 33 — CVEs classified under CWE-122, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-38427 | High | 7.3 | 2026-05-27 | An issue in fetch_jpg() in xdrv_10_scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buffer overflow. The Content-Length from a J… |
CVE-2026-9605 | High | 7.3 | 2026-05-27 | A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function bit_read_RC of the file bits.c of the component Dwgbmp Utility. This m… |
CVE-2026-44983 | High | 7.3 | 2026-05-26 | smallbitvec is a growable bit-vector for Rust, optimized for size. From 1.0.1 to 2.6.0, an integer overflow in the internal capacity calculation of smallbitvec… |
CVE-2026-48689 | Critical | 9.8 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hp… |
CVE-2026-8834 | High | 8.0 | 2026-05-26 | IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. A privileged user, authenticated to the Administration Server, could exploit this vulner… |
CVE-2026-48691 | Critical | 9.8 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH attribute encoder. In src/bgp_protocol.hpp, the IPv4UnicastAnnounce… |
CVE-2026-48690 | High | 7.1 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains an integer overflow vulnerability in the packet capture buffer allocation. In src/packet_storage.hpp, the a… |
CVE-2026-40033 | High | 8.8 | 2026-05-26 | FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The… |
CVE-2026-9541 | Medium | 5.3 | 2026-05-26 | A security flaw has been discovered in Squirrel up to 3.2. Impacted is the function ReadObject of the file squirrel/sqobject.cpp of the component Cnut File Han… |
CVE-2026-7310 | | 2026-05-26 | A heap-based buffer overflow vulnerability exists in XML parser functionality in the HiDraw. An authenticated malicious user with local access can exploit this… | |
CVE-2026-48135 | Medium | 5.3 | 2026-05-26 | A Check Point HTTP-based service can incorrectly handle malformed HTTP requests. The issue is related to HTTP request parsing and validation. |
CVE-2026-48131 | High | 8.1 | 2026-05-26 | The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage of a connection attempt. This can cause… |
CVE-2026-25713 | High | 7.8 | 2026-05-26 | A heap-based buffer overflow vulnerability exists in the ID3v2 parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted media file that c… |
CVE-2026-9502 | Medium | 5.3 | 2026-05-25 | A vulnerability was identified in GNU LibreDWG up to 0.14. This affects the function decompress_R2004_section of the file src/decode.c of the component Dwgread… |
CVE-2026-9500 | Medium | 5.3 | 2026-05-25 | A vulnerability was found in GNU LibreDWG up to 0.14. The affected element is the function read_2004_compressed_section of the file src/decode.c of the compone… |
CVE-2026-9365 | Medium | 5.6 | 2026-05-24 | A vulnerability has been found in Ettercap up to 0.8.3. The affected element is the function FUNC_DECODER of the file src/dissectors/ec_gg.c of the component G… |
CVE-2026-9256 | High | 8.1 | 2026-05-22 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pa… |
CVE-2026-8997 | | 2026-05-22 | vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the applicat… | |
CVE-2026-45252 | Medium | 5.5 | 2026-05-21 | When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list of extended… |
CVE-2026-44050 | Critical | 9.9 | 2026-05-21 | A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to execute arbitrary… |
CVE-2026-9149 | Medium | 6.5 | 2026-05-21 | A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size v… |
CVE-2026-8631 | Critical | 9.8 | 2026-05-20 | A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of priv… |
CVE-2026-9123 | High | 7.5 | 2026-05-20 | Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a local attacker to execute arbitrary code insi… |
CVE-2026-9119 | High | 8.8 | 2026-05-20 | Heap buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
CVE-2026-22554 | High | 7.8 | 2026-05-20 | A heap-based buffer overflow vulnerability exists in the Channel Splitting functionality of MediaInfoLib (version(s): 26.01). A specially crafted .riff file ca… |
CVE-2026-45584 | High | 8.1 | 2026-05-20 | Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network. |
CVE-2026-32741 | High | 7.1 | 2026-05-19 | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_image(). Wh… |
CVE-2026-33633 | High | 7.5 | 2026-05-19 | Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can w… |
CVE-2026-8711 | High | 8.1 | 2026-05-19 | NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*… |
CVE-2026-47311 | High | 7.8 | 2026-05-19 | Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da850d846ce6ba… |
CVE-2026-44662 | | 2026-05-14 | rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.0 to before 0.10.79, CipherCtxRef::cipher_update, CipherCtxRef::cipher_upda… | |
CVE-2026-8560 | Medium | 4.3 | 2026-05-14 | Heap buffer overflow in SwiftShader in Google Chrome on Mac and iOS prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory read v… |
CVE-2026-8552 | Medium | 4.3 | 2026-05-14 | Heap buffer overflow in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafte… |
CVE-2026-8531 | High | 8.8 | 2026-05-14 | Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2026-8529 | High | 8.8 | 2026-05-14 | Heap buffer overflow in Codecs in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted vide… |
CVE-2026-8525 | High | 8.3 | 2026-05-14 | Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
CVE-2026-8509 | High | 8.8 | 2026-05-14 | Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… |
CVE-2026-44636 | High | 7.4 | 2026-05-14 | libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, signed integer overflow in sixel_encode_highcolor's allocatio… |
CVE-2026-43906 | High | 7.8 | 2026-05-14 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13… |
CVE-2026-0264 | Critical | 9.8 | 2026-05-13 | A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network… |
CVE-2026-42945 | High | 8.1 | 2026-05-13 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed b… |
CVE-2025-62624 | | 2026-05-13 | A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitr… | |
CVE-2026-23827 | High | 7.5 | 2026-05-12 | A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to ac… |
CVE-2026-42896 | High | 7.8 | 2026-05-12 | Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2026-42831 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-41096 | Critical | 9.8 | 2026-05-12 | Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network. |
CVE-2026-40407 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-40403 | High | 8.8 | 2026-05-12 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally. |
CVE-2026-40398 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. |
CVE-2026-40380 | Medium | 6.2 | 2026-05-12 | Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack. |
CVE-2026-40377 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-40364 | High | 8.4 | 2026-05-12 | Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-40363 | High | 8.4 | 2026-05-12 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-40362 | High | 7.8 | 2026-05-12 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-35421 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally. |
CVE-2026-35420 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-34687 | High | 7.8 | 2026-05-12 | Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the c… |
CVE-2026-34642 | High | 7.8 | 2026-05-12 | After Effects versions 26.0, 25.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the… |
CVE-2026-34343 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Application Identity (AppID) Subsystem allows an authorized attacker to elevate privileges locally. |
CVE-2026-34336 | High | 7.8 | 2026-05-12 | Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2026-34329 | High | 8.8 | 2026-05-12 | Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network. |
CVE-2026-33841 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-33837 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
CVE-2026-32177 | High | 7.3 | 2026-05-12 | Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-12659 | High | 7.8 | 2026-05-12 | Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted IPT files. This could allow an attacker to execute code in t… |
CVE-2026-42046 | High | 7.8 | 2026-05-11 | libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacke… |
CVE-2026-4892 | High | 8.4 | 2026-05-11 | A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges vi… |
CVE-2026-8261 | Medium | 5.9 | 2026-05-11 | A vulnerability was determined in Squirrel up to 3.2. This affects the function SQFunctionProto::Load of the file squirrel/sqobject.cpp. This manipulation caus… |
CVE-2026-8213 | Medium | 5.3 | 2026-05-09 | A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hdf-eos/GDapi.c of th… |
CVE-2026-8212 | Medium | 5.3 | 2026-05-09 | A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Execu… |
CVE-2026-42309 | Medium | 5.5 | 2026-05-09 | Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as I… |
CVE-2026-45130 | Medium | 6.6 | 2026-05-08 | Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a… |
CVE-2026-41509 | Critical | 9.8 | 2026-05-08 | CROSS implementation contains reference and optimized implementations of the CROSS post-quantum signature algorithm. Prior to commit fc6b7e7, there is a buffer… |
CVE-2026-8087 | Medium | 5.3 | 2026-05-07 | A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a m… |
CVE-2026-8086 | Medium | 5.3 | 2026-05-07 | A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file frmts/hdf4/hdf-eos/SWapi.c. Such manipul… |
CVE-2026-7900 | High | 8.3 | 2026-05-06 | Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-20185 | High | 7.7 | 2026-05-06 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco 350 Series Managed Switches (SG350) and Cisco 350X Series Stackable Ma… |
CVE-2026-6210 | | 2026-05-06 | A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. When processing SVG marker references, th… | |
CVE-2026-28780 | Critical | 9.8 | 2026-05-05 | Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a… |
CVE-2026-25589 | High | 8.8 | 2026-05-05 | RedisBloom is a probabilistic data structures module for Redis. In all versions of RedisBloom before 2.8.20, the module does not properly validate serialized v… |
CVE-2026-25588 | High | 8.8 | 2026-05-05 | RedisTimeSeries is a time-series module for Redis. In all versions before 1.12.14 of RedisTimeSeries, the module does not properly validate serialized values p… |
CVE-2026-25243 | High | 8.8 | 2026-05-05 | Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authe… |
CVE-2026-39103 | Medium | 5.5 | 2026-05-05 | Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scene… |
CVE-2026-29004 | High | 8.1 | 2026-05-04 | BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dh… |
CVE-2025-70067 | Critical | 9.8 | 2026-05-04 | Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. The vulnerability occurs in aiMaterial::AddBinaryProperty, where a pro… |
CVE-2026-42477 | High | 7.1 | 2026-05-01 | A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows user-assisted at… |
CVE-2026-42483 | Critical | 9.8 | 2026-05-01 | A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code v… |
CVE-2026-5405 | High | 7.8 | 2026-05-01 | RDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution |
CVE-2026-5403 | High | 7.8 | 2026-05-01 | SBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution |
CVE-2026-42512 | High | 8.1 | 2026-04-30 | As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expands the array incorr… |
CVE-2026-35547 | High | 8.1 | 2026-04-30 | When processing the header of an incoming message, libnv failed to properly validate the message size. The lack of validation allows a malicious program to wr… |
CVE-2026-6530 | Medium | 5.5 | 2026-04-30 | DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-6529 | Medium | 5.5 | 2026-04-30 | iLBC audio codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-5653 | Medium | 5.5 | 2026-04-30 | DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-5402 | High | 8.8 | 2026-04-30 | TLS protocol dissector heap overflow in Wireshark 4.6.0 to 4.6.4 allows denial of service and possible code execution |
CVE-2026-7378 | Medium | 5.5 | 2026-04-30 | Crash in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-7353 | High | 8.3 | 2026-04-28 | Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-7339 | High | 8.8 | 2026-04-28 | Heap buffer overflow in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2026-20766 | High | 8.8 | 2026-04-28 | An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras. |
CVE-2026-7040 | High | 7.5 | 2026-04-27 | Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters. The minify functions mishandl… |