CWE-122 · Heap-based Buffer Overflow (page 6)
Page 6 of 27 — CVEs classified under CWE-122, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8529 | High | 8.8 | 2026-05-14 | Heap buffer overflow in Codecs in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted vide… |
CVE-2026-8525 | High | 8.3 | 2026-05-14 | Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
CVE-2026-8509 | High | 8.8 | 2026-05-14 | Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… |
CVE-2026-44636 | High | 7.4 | 2026-05-14 | libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, signed integer overflow in sixel_encode_highcolor's allocatio… |
CVE-2026-43906 | High | 7.8 | 2026-05-14 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13… |
CVE-2026-0264 | Critical | 9.8 | 2026-05-13 | A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network… |
CVE-2026-42945 | High | 8.1 | 2026-05-13 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed b… |
CVE-2025-62624 | | 2026-05-13 | A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitr… | |
CVE-2026-23827 | High | 7.5 | 2026-05-12 | A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to ac… |
CVE-2026-42896 | High | 7.8 | 2026-05-12 | Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2026-42831 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-41096 | Critical | 9.8 | 2026-05-12 | Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network. |
CVE-2026-40407 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-40403 | High | 8.8 | 2026-05-12 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally. |
CVE-2026-40398 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. |
CVE-2026-40380 | Medium | 6.2 | 2026-05-12 | Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack. |
CVE-2026-40377 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-40364 | High | 8.4 | 2026-05-12 | Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-40363 | High | 8.4 | 2026-05-12 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-40362 | High | 7.8 | 2026-05-12 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-35421 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally. |
CVE-2026-35420 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-34687 | High | 7.8 | 2026-05-12 | Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the c… |
CVE-2026-34642 | High | 7.8 | 2026-05-12 | After Effects versions 26.0, 25.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the… |
CVE-2026-34343 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Application Identity (AppID) Subsystem allows an authorized attacker to elevate privileges locally. |
CVE-2026-34336 | High | 7.8 | 2026-05-12 | Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2026-34329 | High | 8.8 | 2026-05-12 | Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network. |
CVE-2026-33841 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-33837 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
CVE-2026-32177 | High | 7.3 | 2026-05-12 | Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-12659 | High | 7.8 | 2026-05-12 | Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted IPT files. This could allow an attacker to execute code in t… |
CVE-2026-42046 | High | 7.8 | 2026-05-11 | libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacke… |
CVE-2026-4892 | High | 8.4 | 2026-05-11 | A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges vi… |
CVE-2026-8261 | Medium | 5.9 | 2026-05-11 | A vulnerability was determined in Squirrel up to 3.2. This affects the function SQFunctionProto::Load of the file squirrel/sqobject.cpp. This manipulation caus… |
CVE-2026-8213 | Medium | 5.3 | 2026-05-09 | A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hdf-eos/GDapi.c of th… |
CVE-2026-8212 | Medium | 5.3 | 2026-05-09 | A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Execu… |
CVE-2026-42309 | Medium | 5.5 | 2026-05-09 | Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as I… |
CVE-2026-45130 | Medium | 6.6 | 2026-05-08 | Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a… |
CVE-2026-41509 | Critical | 9.8 | 2026-05-08 | CROSS implementation contains reference and optimized implementations of the CROSS post-quantum signature algorithm. Prior to commit fc6b7e7, there is a buffer… |
CVE-2026-8087 | Medium | 5.3 | 2026-05-07 | A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a m… |
CVE-2026-8086 | Medium | 5.3 | 2026-05-07 | A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file frmts/hdf4/hdf-eos/SWapi.c. Such manipul… |
CVE-2026-7900 | High | 8.3 | 2026-05-06 | Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-20185 | High | 7.7 | 2026-05-06 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco 350 Series Managed Switches (SG350) and Cisco 350X Series Stackable Ma… |
CVE-2026-6210 | | 2026-05-06 | A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. When processing SVG marker references, th… | |
CVE-2026-28780 | Critical | 9.8 | 2026-05-05 | Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a… |
CVE-2026-25589 | High | 8.8 | 2026-05-05 | RedisBloom is a probabilistic data structures module for Redis. In all versions of RedisBloom before 2.8.20, the module does not properly validate serialized v… |
CVE-2026-25588 | High | 8.8 | 2026-05-05 | RedisTimeSeries is a time-series module for Redis. In all versions before 1.12.14 of RedisTimeSeries, the module does not properly validate serialized values p… |
CVE-2026-25243 | High | 8.8 | 2026-05-05 | Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authe… |
CVE-2026-39103 | Medium | 5.5 | 2026-05-05 | Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scene… |
CVE-2026-29004 | High | 8.1 | 2026-05-04 | BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dh… |
CVE-2025-70067 | Critical | 9.8 | 2026-05-04 | Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. The vulnerability occurs in aiMaterial::AddBinaryProperty, where a pro… |
CVE-2026-42477 | High | 7.1 | 2026-05-01 | A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows user-assisted at… |
CVE-2026-42483 | Critical | 9.8 | 2026-05-01 | A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code v… |
CVE-2026-5405 | High | 7.8 | 2026-05-01 | RDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution |
CVE-2026-5403 | High | 7.8 | 2026-05-01 | SBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution |
CVE-2026-42512 | High | 8.1 | 2026-04-30 | As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expands the array incorr… |
CVE-2026-35547 | High | 8.1 | 2026-04-30 | When processing the header of an incoming message, libnv failed to properly validate the message size. The lack of validation allows a malicious program to wr… |
CVE-2026-6530 | Medium | 5.5 | 2026-04-30 | DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-6529 | Medium | 5.5 | 2026-04-30 | iLBC audio codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-5653 | Medium | 5.5 | 2026-04-30 | DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-5402 | High | 8.8 | 2026-04-30 | TLS protocol dissector heap overflow in Wireshark 4.6.0 to 4.6.4 allows denial of service and possible code execution |
CVE-2026-7378 | Medium | 5.5 | 2026-04-30 | Crash in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-7353 | High | 8.3 | 2026-04-28 | Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-7339 | High | 8.8 | 2026-04-28 | Heap buffer overflow in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2026-20766 | High | 8.8 | 2026-04-28 | An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras. |
CVE-2026-7040 | High | 7.5 | 2026-04-27 | Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters. The minify functions mishandl… |
CVE-2026-33602 | Medium | 6.5 | 2026-04-22 | A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading t… |
CVE-2026-6846 | High | 7.8 | 2026-04-22 | A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object… |
CVE-2026-40706 | High | 8.4 | 2026-04-21 | In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory… |
CVE-2026-40614 | High | 8.8 | 2026-04-21 | PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer overflow when decoding Opus audio frames… |
CVE-2026-5450 | Critical | 9.8 | 2026-04-20 | Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with… |
CVE-2026-32135 | High | 7.5 | 2026-04-20 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the `uri_pa… |
CVE-2026-41445 | High | 8.8 | 2026-04-20 | KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calcula… |
CVE-2026-32961 | Medium | 5.3 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in packet data processing of sx_smpd. Processing… |
CVE-2026-32956 | Critical | 9.8 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in processing the redirect URLs. Arbitrary code… |
CVE-2026-35512 | High | 8.8 | 2026-04-17 | xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX (graphics dynamic virtual channel) implementation due… |
CVE-2026-32624 | Medium | 6.5 | 2026-04-17 | xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in its logon processing. In environments where do… |
CVE-2026-32623 | High | 8.1 | 2026-04-17 | xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sess… |
CVE-2026-6491 | Medium | 5.3 | 2026-04-17 | A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec of the file libvips/deprecated/vips7comp… |
CVE-2026-40504 | Critical | 9.8 | 2026-04-16 | Creolabs Gravity before 0.9.6 contains a heap buffer overflow vulnerability in the gravity_vm_exec function that allows attackers to write out-of-bounds memory… |
CVE-2026-6361 | High | 8.3 | 2026-04-15 | Heap buffer overflow in PDFium in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-6306 | High | 8.8 | 2026-04-15 | Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF… |
CVE-2026-6305 | High | 8.8 | 2026-04-15 | Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF… |
CVE-2026-6298 | Medium | 4.3 | 2026-04-15 | Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2026-6296 | Critical | 9.6 | 2026-04-15 | Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML pag… |
CVE-2026-27301 | Medium | 5.5 | 2026-04-14 | Adobe Framemaker versions 2022.8 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure. An attacker could l… |
CVE-2026-27293 | High | 7.8 | 2026-04-14 | Adobe Framemaker versions 2022.8 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-33020 | High | 7.1 | 2026-04-14 | libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow which leads to a heap buffe… |
CVE-2026-34630 | High | 7.8 | 2026-04-14 | Bridge versions 16.0.2, 15.1.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the cont… |
CVE-2026-27313 | High | 7.8 | 2026-04-14 | Bridge versions 16.0.2, 15.1.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the cont… |
CVE-2026-27312 | High | 7.8 | 2026-04-14 | Bridge versions 16.0.2, 15.1.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the cont… |
CVE-2026-27311 | High | 7.8 | 2026-04-14 | Bridge versions 16.0.2, 15.1.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the cont… |
CVE-2026-27310 | High | 7.8 | 2026-04-14 | Bridge versions 16.0.2, 15.1.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the cont… |
CVE-2026-34629 | High | 7.8 | 2026-04-14 | InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in… |
CVE-2026-34628 | High | 7.8 | 2026-04-14 | InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in… |
CVE-2026-34627 | High | 7.8 | 2026-04-14 | InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in… |
CVE-2026-32223 | Medium | 6.8 | 2026-04-14 | Heap-based buffer overflow in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
CVE-2026-32221 | High | 8.4 | 2026-04-14 | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally. |
CVE-2026-32149 | High | 7.3 | 2026-04-14 | Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-32093 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized atta… |