CWE-122 · Heap-based Buffer Overflow (page 4)
Page 4 of 27 — CVEs classified under CWE-122, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-49172 | Critical | 9.8 | 2026-07-14 | Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network. |
CVE-2026-49164 | High | 8.1 | 2026-07-14 | Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. |
CVE-2026-48564 | High | 8.8 | 2026-07-14 | Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network. |
CVE-2026-42990 | Critical | 9.8 | 2026-07-14 | Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network. |
CVE-2026-42975 | High | 8.0 | 2026-07-14 | Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network. |
CVE-2026-15520 | Medium | 5.3 | 2026-07-13 | A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompress_R2004_section of the file src/decode.c of the compone… |
CVE-2026-15506 | High | 7.8 | 2026-07-12 | A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected element is an unknown function in the library saappctl.sys of the… |
CVE-2026-56372 | Low | 3.3 | 2026-07-11 | ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrec… |
CVE-2026-57156 | Critical | 9.8 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_d… |
CVE-2026-54001 | | 2026-07-10 | osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Windows, a local unprivileged attacker can… | |
CVE-2026-54000 | | 2026-07-10 | osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Windows, a local unprivileged attacker can… | |
CVE-2026-15028 | Low | 3.9 | 2026-07-10 | A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue… |
CVE-2026-15182 | Medium | 5.3 | 2026-07-09 | A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwg_bmp of the file src/dwg.c of the component BMP Image Hand… |
CVE-2026-58306 | Medium | 6.1 | 2026-07-09 | Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before ef525f337fafddecde77a3c4… |
CVE-2026-15123 | High | 8.8 | 2026-07-08 | Inappropriate implementation in DOM in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2026-15174 | Medium | 5.5 | 2026-07-08 | Catapult DCT2000 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service |
CVE-2026-15173 | Medium | 4.7 | 2026-07-08 | pcapng file parser crash in Wireshark 4.6.0 to 4.6.6 allows denial of service |
CVE-2026-15170 | Medium | 5.5 | 2026-07-08 | Z39.50 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service |
CVE-2026-15169 | Medium | 5.5 | 2026-07-08 | UMTS FP protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service |
CVE-2026-15165 | Medium | 5.5 | 2026-07-08 | TLS ECH decryptor crash in Wireshark 4.6.0 to 4.6.6 allows denial of service |
CVE-2026-15164 | Medium | 5.5 | 2026-07-08 | Crash in ciscodump 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service |
CVE-2026-56003 | High | 8.5 | 2026-07-08 | A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 befor… |
CVE-2026-56002 | High | 8.5 | 2026-07-08 | A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code w… |
CVE-2026-56001 | High | 8.5 | 2026-07-08 | A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server… |
CVE-2026-55999 | High | 8.5 | 2026-07-08 | Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffe… |
CVE-2026-58471 | Medium | 5.9 | 2026-07-07 | GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows re… |
CVE-2026-14940 | Medium | 5.3 | 2026-07-07 | A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value enc… |
CVE-2026-11610 | High | 8.8 | 2026-07-07 | A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF… |
CVE-2025-15668 | Low | 3.3 | 2026-07-06 | A vulnerability was identified in GPAC up to b40ce70f5. This issue affects the function sgpd_del_entry of the file src/isomedia/box_code_base.c of the componen… |
CVE-2026-14759 | Low | 3.3 | 2026-07-05 | A security flaw has been discovered in radareorg radare2 up to 6.1.6. This issue affects the function r_bin_java_inner_classes_attr_calc_size of the file shlr/… |
CVE-2026-56645 | High | 8.8 | 2026-07-03 | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-14610 | Medium | 5.3 | 2026-07-03 | A flaw has been found in Open Asset Import Library Assimp up to 6.0.5. Impacted is the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/C… |
CVE-2026-14355 | Medium | 5.6 | 2026-07-03 | In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extensi… |
CVE-2026-58379 | High | 7.3 | 2026-07-03 | A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code ex… |
CVE-2026-14427 | High | 8.3 | 2026-07-01 | Heap buffer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-14415 | High | 8.8 | 2026-07-01 | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2026-14385 | High | 8.8 | 2026-07-01 | Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to perform out of bounds memory access via a crafted HTM… |
CVE-2025-15666 | Medium | 5.3 | 2026-07-01 | A security vulnerability has been detected in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function Assimp::SceneCombine… |
CVE-2026-20462 | Medium | 6.7 | 2026-07-01 | In Telephony, there is a possible memory corruption due to a heap buffer overflow. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2026-54896 | | 2026-07-01 | Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in object mode, Oj.dump is vulnerable to a… | |
CVE-2026-54696 | Low | 3.7 | 2026-06-30 | Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an o… |
CVE-2026-13976 | Medium | 5.8 | 2026-06-30 | Insufficient data validation in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2026-13884 | High | 8.8 | 2026-06-30 | Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via malicious network traffic. (Chrom… |
CVE-2026-13835 | High | 8.8 | 2026-06-30 | Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2026-13798 | Critical | 9.6 | 2026-06-30 | Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-51219 | High | 7.5 | 2026-06-29 | A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.3.3 to v2.3.6 allows attackers to cause a Denial of Service… |
CVE-2026-51218 | High | 7.5 | 2026-06-29 | A heap buffer overflow in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3 allows attackers to cause a Denial of Service (D… |
CVE-2026-13590 | Medium | 5.6 | 2026-06-29 | A security flaw has been discovered in seladb PcapPlusPlus 25.05. This impacts the function pcpp::ModbusLayer::getLength in the library Packet++/header/ModbusL… |
CVE-2026-13589 | Medium | 5.6 | 2026-06-29 | A vulnerability was identified in seladb PcapPlusPlus 25.05. This affects the function pcpp::TelnetLayer::getSubCommand of the file Packet++/src/TelnetLayer.cp… |
CVE-2026-13588 | Medium | 5.6 | 2026-06-29 | A vulnerability was determined in seladb PcapPlusPlus 25.05. The impacted element is the function pcpp::SSLClientHelloMessage::getHandshakeVersion of the file… |
CVE-2026-12912 | High | 7.3 | 2026-06-29 | A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occ… |
CVE-2026-13587 | Low | 3.7 | 2026-06-29 | A vulnerability was found in seladb PcapPlusPlus 25.05. The affected element is the function parse_by_block_type of the file light_pcapng.c of the component Li… |
CVE-2026-13574 | Low | 3.3 | 2026-06-29 | A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst… |
CVE-2026-30040 | Medium | 6.5 | 2026-06-26 | A heap overflow in the FSViewer.exe process of FastStone Image Viewer v8.3 allows attackers to cause a execute arbitrary code in the context of the current pro… |
CVE-2026-56789 | Medium | 6.5 | 2026-06-25 | RTKLIB through 2.4.3 contains a heap buffer overflow vulnerability in the readrnxobsb function in src/rinex.c that allows attackers to trigger memory corruptio… |
CVE-2026-56123 | High | 8.1 | 2026-06-25 | socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allows a malicious SOCKS5 proxy server to overwrite adjacent hea… |
CVE-2026-12844 | High | 7.5 | 2026-06-25 | List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. pairwise() collects the values returned by the block i… |
CVE-2026-46752 | | 2026-06-25 | Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.0.4 through 2.15.0. Users are recommended… | |
CVE-2026-12244 | High | 8.8 | 2026-06-25 | If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with… |
CVE-2026-2050 | High | 7.8 | 2026-06-24 | GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2025-60468 | Medium | 5.5 | 2026-06-24 | GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. The impact is: cause a denial of ser… |
CVE-2026-12725 | Medium | 5.9 | 2026-06-22 | A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupp… |
CVE-2026-12805 | Medium | 6.3 | 2026-06-21 | A flaw has been found in OFFIS DCMTK up to 3.7.0. The affected element is the function XMLNode::parseFile in the library ofstd/libsrc/ofxml.cc. Executing a man… |
CVE-2026-56208 | High | 7.6 | 2026-06-19 | A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode… |
CVE-2026-3195 | High | 7.4 | 2026-06-19 | A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pcm_in_cb` function did not check whether the iov c… |
CVE-2026-45696 | Medium | 6.5 | 2026-06-18 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.1… |
CVE-2026-2467 | High | 8.1 | 2026-06-17 | Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professiona… |
CVE-2026-42055 | High | 8.1 | 2026-06-17 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the prox… |
CVE-2026-12466 | High | 8.8 | 2026-06-17 | Heap buffer overflow in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page… |
CVE-2026-12447 | High | 8.8 | 2026-06-17 | Heap buffer overflow in WebRTC in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… |
CVE-2026-47747 | High | 7.8 | 2026-06-16 | stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. In versions pr… |
CVE-2026-0149 | High | 8.8 | 2026-06-16 | In RtpSession::rtpSendRtcpPacket, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional exec… |
CVE-2026-0132 | High | 8.8 | 2026-06-16 | In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileg… |
CVE-2026-0130 | Low | 3.5 | 2026-06-16 | In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no a… |
CVE-2026-47964 | High | 7.8 | 2026-06-16 | DNG SDK versions 1.7.1 2536 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context… |
CVE-2026-47749 | High | 7.8 | 2026-06-16 | stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior… |
CVE-2026-8484 | | 2026-06-16 | A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl()" wrapper due to a lack of size verification for the argument array before the system call… | |
CVE-2026-52720 | High | 8.8 | 2026-06-15 | A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than indivi… |
CVE-2025-55661 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafte… |
CVE-2025-55652 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the gf_isom_vp_config_new function (isomedia/avc_ext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via s… |
CVE-2025-55648 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the gf_opus_parse_packet_header function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service… |
CVE-2025-55645 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the gf_cenc_set_pssh function (isomedia/drm_sample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via sup… |
CVE-2026-12193 | High | 7.8 | 2026-06-15 | A vulnerability was identified in VS Revo RevoUninstaller 2.5.x/2.6.x. The affected element is the function IOCtl_Handler in the library RevoDetector.sys of th… |
CVE-2026-48914 | Medium | 6.7 | 2026-06-12 | A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data… |
CVE-2026-12030 | High | 8.3 | 2026-06-11 | Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentiall… |
CVE-2026-12010 | High | 8.3 | 2026-06-11 | Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2026-53465 | Medium | 6.2 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25, a crafted multi-frame can result in a… |
CVE-2026-48994 | Medium | 5.9 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a r… |
CVE-2026-46692 | Medium | 4.1 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can co… |
CVE-2026-46520 | High | 7.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple… |
CVE-2026-2049 | High | 7.8 | 2026-06-10 | GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-11604 | Medium | 6.5 | 2026-06-10 | An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigg… |
CVE-2026-11884 | Medium | 6.5 | 2026-06-10 | A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the oc_superior (SUP) field length is omitted from buf… |
CVE-2026-45542 | High | 7.1 | 2026-06-10 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a heap buffer overflow exists in the… |
CVE-2026-48292 | High | 7.8 | 2026-06-09 | Format Plugins versions 1.1.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-48291 | High | 7.8 | 2026-06-09 | Format Plugins versions 1.1.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-47952 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code e… |
CVE-2026-11824 | High | 7.8 | 2026-06-09 | SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execu… |
CVE-2026-11822 | High | 7.8 | 2026-06-09 | SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory ex… |
CVE-2023-43688 | High | 7.5 | 2026-06-09 | An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later). There is a Heap buffer overflow in various buffer encryption utilities. |