CWE-122: Heap-based Buffer Overflow

Code Examples & CVEs

Demonstrative Examples

While buffer overflow examples can be rather complex, it is possible to have very simple, yet still exploitable, heap-based buffer overflows:

The buffer is allocated heap memory with a fixed size, but there is no guarantee the string in argv[1] will not exceed this size and cause an overflow.

BadC

#define BUFSIZE 256int main(int argc, char **argv) {char *buf;buf = (char *)malloc(sizeof(char)*BUFSIZE);strcpy(buf, argv[1]);}

This example applies an encoding procedure to an input string and stores it into a buffer.

The programmer attempts to encode the ampersand character in the user-controlled string, however the length of the string is validated before the encoding procedure is applied. Furthermore, the programmer assumes encoding expansion will only expand a given character by a factor of 4, while the encoding of the ampersand expands by 5. As a result, when the encoding procedure expands the string it is possible to overflow the destination buffer if the attacker provides a string of many ampersands.

BadC

char * copy_input(char *user_supplied_string){                         int i, dst_index;char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE);if ( MAX_SIZE <= strlen(user_supplied_string) ){die("user string too long, die evil hacker!");}dst_index = 0;for ( i = 0; i < strlen(user_supplied_string); i++ ){                               if( '&' == user_supplied_string[i] ){dst_buf[dst_index++] = '&';dst_buf[dst_index++] = 'a';dst_buf[dst_index++] = 'm';dst_buf[dst_index++] = 'p';dst_buf[dst_index++] = ';';}else if ('<' == user_supplied_string[i] ){                                                                                                                     /* encode to &lt; */                                                                                                               }else dst_buf[dst_index++] = user_supplied_string[i];                            }return dst_buf;                      }

Observed CVE Examples (6)

CVE-2025-46687

Chain: Javascript engine code does not perform a length check (CWE-1284) leading to integer overflow (CWE-190) causing allocation of smaller buffer than expected (CWE-131) resulting in a heap-based buffer overflow (CWE-122)

View Details

CVE-2021-43537

Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit integer (CWE-681) and potentially leading to an integer overflow (CWE-190). If an integer overflow occurs, this can cause heap memory corruption (CWE-122)

View Details

CVE-2007-4268

Chain: integer signedness error (CWE-195) passes signed comparison, leading to heap overflow (CWE-122)

View Details

CVE-2009-2523

Chain: product does not handle when an input string is not NULL terminated (CWE-170), leading to buffer over-read (CWE-125) or heap-based buffer overflow (CWE-122).

View Details

CVE-2021-29529

Chain: machine-learning product can have a heap-based buffer overflow (CWE-122) when some integer-oriented bounds are calculated by using ceiling() and floor() on floating point values (CWE-1339)

View Details

CVE-2010-1866

Chain: integer overflow (CWE-190) causes a negative signed value, which later bypasses a maximum-only check (CWE-839), leading to heap-based buffer overflow (CWE-122).

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine review and analysis around the CWE-122 trust boundary

MITRE identifies fuzzing, automated dynamic analysis as applicable detection approaches. Use them to pair each heap allocation with the intended element count and prove all later offsets, copies, and reallocation paths remain within that object. Require a reproducible source-to-sink or policy-to-enforcement trace, record coverage gaps, and confirm suspected findings dynamically where safe; no single scanner can establish complete coverage for this weakness.

CWE-122: detection methods and operational guidance — MITRE CWE

Eliminate heap-buffer overflows through memory-safe allocation and access

Prefer memory-safe languages and libraries for new components and migrate exposed unsafe code where practical. In remaining heap code, validate allocation-size arithmetic, retain the actual capacity with each allocation, and prove every index, copy, and terminator stays within that capacity. Exercise zero-length, resized, maximum-length, and one-past-the-end cases with static analysis and runtime memory-safety detection.

Secure by Design Alert: Eliminating Buffer Overflow Vulnerabilities — CISA

Apply lessons from CVE-2025-24993 in Microsoft Windows NTFS

NVD maps CVE-2025-24993 to CWE-122; a heap-based buffer overflow allowed an unauthorized attacker to execute code locally and was added to CISA’s Known Exploited Vulnerabilities catalog. Use the case to treat filesystem parsers as high-impact boundaries, validate all on-disk lengths before heap access, and fuzz mounted-image and local file inputs under memory instrumentation.

CVE-2025-24993 Detail — NIST National Vulnerability Database

Prioritize CWE-122 using its 2025 CWE Top 25 evidence

CWE-122 ranked #16 in the 2025 CWE Top 25 with a score of 5.21. The ranking table recorded 6 mapped vulnerabilities in CISA KEV for this measurement window. Use the rank to prioritize systemic prevention, detection coverage, and recurring-root-cause metrics across the portfolio, while retaining asset exposure and business impact for individual finding severity decisions.

2025 CWE Top 25 Most Dangerous Software Weaknesses — MITRE CWE

Stress heap object sizes under AddressSanitizer

Instrument native components with AddressSanitizer and test malformed size fields, integer-boundary values, exact-fit and one-past-the-end writes, reallocation failures, and parser recovery paths. Run both targeted regression cases and coverage-guided fuzzing. Fix the allocation or access invariant rather than suppressing the report, and review unexecuted pointer arithmetic separately.

AddressSanitizer — LLVM Project

Frequently Asked Questions

What is CWE-122: Heap-based Buffer Overflow?+

CWE-122: Heap-based Buffer Overflow is a Common Weakness Enumeration (CWE) entry maintained by MITRE. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

What are the security consequences of Heap-based Buffer Overflow?+

If exploited, CWE-122 (Heap-based Buffer Overflow) it can compromise Availability, Integrity, Confidentiality, Access Control and Other, leading to outcomes such as DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), Execute Unauthorized Code or Commands, Bypass Protection Mechanism and Modify Memory.

How do you prevent or mitigate Heap-based Buffer Overflow?+

Recommended mitigations for CWE-122 include: Pre-design: Use a language or compiler that performs automatic bounds checking. Use an abstraction library to abstract away risky APIs. Not a complete solution. Implement and perform bounds checking on input.

Which programming languages are affected by Heap-based Buffer Overflow?+

CWE-122 commonly affects C, C++ and Memory-Unsafe. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Heap-based Buffer Overflow?+

MITRE documents real CVEs mapped to CWE-122, including CVE-2025-46687, CVE-2021-43537, CVE-2007-4268, CVE-2009-2523 and CVE-2021-29529. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-122 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-122: Heap-based Buffer Overflow

Technical Details

Applicable To

Security Consequences

Scope

Impact

Scope

Impact

Scope

Impact

Mitigation Strategies

Phase

Description

Phase

Description

Phase

Description

Phase

Description

Strategy

Phase

Description

Detection Methods

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (6)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Combine review and analysis around the CWE-122 trust boundary

Eliminate heap-buffer overflows through memory-safe allocation and access

Apply lessons from CVE-2025-24993 in Microsoft Windows NTFS

Prioritize CWE-122 using its 2025 CWE Top 25 evidence

Stress heap object sizes under AddressSanitizer

Frequently Asked Questions

Learn More