CWE-122

High likelihood

Heap-based Buffer Overflow

Parent: CWE-788 - Access of Memory Location After End of Buffer

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

2,545 vulnerabilities with CWE-122
CVE-2026-3147 MEDIUM
libvips < 8.18.0 - Heap-Based Buffer Overflow in CSV Load Function
CVSS 5.3
CVE-2026-26284 MEDIUM
ImageMagick <7.1.2-15/6.9.13-40 - Memory Corruption
CVSS 6.5
CVE-2026-25897 MEDIUM
ImageMagick <7.1.2-15/6.9.13-40 - Memory Corruption
CVSS 6.5
CVE-2026-25794 HIGH
ImageMagick <7.1.2-15 - Memory Corruption
CVSS 8.2
CVE-2026-25576 MEDIUM
ImageMagick <7.1.2-15/6.9.13-40 - Buffer Overflow
CVSS 5.1
CVE-2026-2913 LOW
libvips < 8.19.0 - Heap-Based Buffer Overflow in vips_source_read_to_memory
CVSS 2.5
CVE-2026-27168 HIGH
sail/sail < 0.9.10 - Heap-based Buffer Overflow in XWD Parser
CVSS 8.8
CVE-2026-2047 HIGH
GIMP - Heap-based Buffer Overflow RCE
CVSS 7.8
CVE-2026-0797 HIGH
GIMP - Heap-based Buffer Overflow RCE
CVSS 8.8
CVE-2026-26967 MEDIUM
pjsip < 2.17 - Heap-based Buffer Overflow in H.264 Unpacketizer
CVSS 5.3
CVE-2026-26200 HIGH
HDF5 < 1.14.4.2 - Heap Buffer Overflow via Crafted h5 File
CVSS 7.8
CVE-2026-2650 HIGH
Google Chrome <145.0.7632.109 - Buffer Overflow
CVSS 8.8
CVE-2026-2648 HIGH
Google Chrome <145.0.7632.109 - Memory Corruption
CVSS 8.8
CVE-2026-2661 LOW
Squirrel up to 3.2 - Buffer Overflow
CVSS 3.3
CVE-2026-2653 MEDIUM
admesh < 0.98.5 - Heap-Based Buffer Overflow in stl_check_normal_vector
CVSS 5.3
CVE-2026-2474 HIGH
Crypt::URandom 0.41-0.54 - Buffer Overflow
CVSS 7.5
CVE-2026-2447 HIGH
Firefox < 115.32.1, 140.7.1-140.*, < 147.0.4 and Thunderbird < 140.7.2, 147.0.2 - Heap-based Buffer Overflow in libvpx
CVSS 8.8
CVE-2026-26011 CRITICAL
Nav2 AMCL <1.3.11 - Memory Corruption
CVSS 9.8
CVE-2026-2007 HIGH
PostgreSQL <18.1-18.0 - Buffer Overflow
CVSS 8.2
CVE-2026-2005 HIGH
PostgreSQL <18.2, 17.8, 16.12, 15.16, 14.21 - RCE
CVSS 8.8
CVE-2026-2314 HIGH
Google Chrome <145.0.7632.45 - Buffer Overflow
CVSS 8.8
CVE-2026-25646 HIGH
libpng < 1.6.55 - Buffer Over-read in png_set_quantize()
CVSS 8.1
CVE-2026-21358 MEDIUM
InDesign < 20.5.2 - Heap-based Buffer Overflow via Malicious File
CVSS 5.5
CVE-2026-21357 HIGH
InDesign < 20.5.2 - Heap-based Buffer Overflow via Malicious File
CVSS 7.8
CVE-2026-21259 HIGH
Microsoft Office Excel - Privilege Escalation
CVSS 7.8
Details
Vulnerabilities 2,545
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits