Heap-Overflow

A heap out-of-bounds write vulnerability exists in the vf_quirc filter of FFmpeg versions 7.0 through 8.1.2, allowing an attacker to corrupt heap memory and potentially achieve arbitrary code execution by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions.

A heap out-of-bounds write vulnerability, CVE-2026-66040, exists in the native PNG and APNG encoders of FFmpeg through version 8.1.2, allowing remote attackers to corrupt heap memory and achieve potential arbitrary code execution by supplying a crafted PNG image with a malicious eXIf chunk.

FFmpeg versions 2.1 through 8.1.2 contain a heap buffer overflow vulnerability (CVE-2026-64830) in the VobSub subtitle demuxer, allowing attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file, potentially leading to arbitrary code execution in applications using FFmpeg's VobSub demuxer.

A heap overflow vulnerability (CVE-2026-38754) exists in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0. This flaw allows attackers to trigger a Denial of Service (DoS) by providing a specially crafted input, leading to application instability or unavailability.

A vulnerability (CVE-2026-55379) in Pillow's BdfFontFile component allows attackers to craft a malicious BDF font file with oversized BBX dimensions and an empty BITMAP section, bypassing documented decompression bomb protection and causing the Image.new() function to silently allocate large amounts of memory in the C-heap, leading to resource exhaustion and denial-of-service for applications processing untrusted BDF fonts.

A heap-based buffer overflow vulnerability exists in the mod_sftp module of ProFTPD versions prior to 1.3.9c and 1.3.10rc3, allowing authenticated low-privilege attackers to achieve arbitrary code execution by sending specially crafted SFTP packet fragments exceeding 16 KB, corrupting memory and redirecting function calls.

IBM Storage Protect Client versions 8.1.0.0 through 8.1.27.1 and 8.2.0.0 through 8.2.1.0 are vulnerable to CVE-2026-13473, a heap-based buffer overflow caused by improper bounds checking, allowing a remote attacker to execute arbitrary code or crash the server.

A heap overflow and out-of-bounds read vulnerability (CVE-2026-15028) has been identified in the Libarchive library, triggered by parsing a tar archive with a specially crafted pax extended header, potentially leading to denial of service or arbitrary code execution.

A heap-based buffer overflow vulnerability, CVE-2026-15506, in the `saappctl.sys` driver of SecureAge CatchPulse versions up to 10.9.3 allows a local attacker to achieve privilege escalation, and an exploit has been publicly disclosed.

CVE-2026-14739 details a heap overflow vulnerability affecting DBI for Perl versions prior to 1.650, which arises during the preparsing of SQL statements with an excessive number of placeholders, potentially leading to arbitrary code execution or a denial of service.

A heap buffer overflow vulnerability (CVE-2026-59691) exists in GStreamer's rfbsrc plugin, allowing a malicious RFB/VNC server to trigger an out-of-bounds heap write in connecting clients, leading to denial of service and potential memory corruption.

A heap buffer overflow vulnerability, identified as CVE-2026-55999, has been discovered in the xorg-server and xwayland components, specifically within the glamor font atlas functionality, affecting systems using these display servers and potentially leading to arbitrary code execution or denial of service.

A heap buffer overflow vulnerability (CVE-2026-11610) exists in the SASL I/O layer of 389 Directory Server (389-ds-base), active since version 1.3.2. An authenticated attacker can send a specially crafted, oversized LDAP UNBIND packet after a successful SASL bind with integrity protection. This causes approximately 2 megabytes of attacker-controlled data to overflow a 512-byte heap buffer in sasl_io_recv(), leading to a denial of service (server crash).

An integer overflow vulnerability (CVE-2026-58384) exists in GIMP's PSD parser within the `read_RLE_channel()` function, leading to undersized heap allocations that can cause subsequent heap memory corruption, potentially resulting in denial of service or arbitrary code execution.

The `Oj.dump` function in the Ruby `oj` gem, when operating in object mode, is vulnerable to a heap buffer overflow (CVE-2026-54896) when serializing `Exception` objects with an excessively large `:indent` value, leading to memory corruption and potential denial of service or remote code execution.

A remote exploit is available for strongSwan 5.9.13 exploiting a heap buffer overflow in the libsimaka EAP-SIM/AKA module (CVE-2026-35330), enabling pre-authentication exploitation via a malformed EAP-SIM/AKA payload.

A heap overflow vulnerability exists within the DICOM file format, potentially allowing an attacker to target an Orthanc server during image uploads, leading to an out-of-bounds write.

A heap-based buffer overflow vulnerability exists in MediaArea MediaInfoLib's handling of LXF elements, potentially leading to arbitrary code execution when processing maliciously crafted media files; assigned CVE-2026-28764, CVSS 7.8.

Microsoft disclosed CVE-2026-42944, a heap overflow vulnerability related to the processing of multiple NSID, COOKIE, and PADDING EDNS options in an unspecified product.

Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability, tracked as CVE-2009-3459, that could allow remote attackers to execute arbitrary code via a crafted PDF file.

CVE-2026-45584 is a heap-based buffer overflow vulnerability in Microsoft Defender that allows an unauthorized attacker to execute arbitrary code over a network.

A heap buffer over-write vulnerability exists in ImageMagick's IPL decoder when processing multiple images of different dimensions, affecting Magick.NET packages prior to version 14.13.1 and potentially leading to arbitrary code execution.

CVE-2026-44662 is a critical heap buffer overflow vulnerability in rust-openssl during encryption with AES key-wrap-with-padding, potentially leading to arbitrary code execution or denial of service.

A heap-based buffer overflow vulnerability in Siemens Simcenter Femap, tracked as CVE-2025-12659, can be exploited by tricking a user into opening a malicious IPT file, leading to remote code execution.

NGINX Plus and NGINX Open Source are vulnerable to a heap buffer overflow (CVE-2026-42945) due to crafted HTTP requests when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed PCRE capture with a replacement string that includes a question mark, potentially leading to denial of service or code execution.

CVE-2026-0264 is a heap-based buffer overflow vulnerability in Palo Alto Networks PAN-OS DNS proxy and DNS server features, allowing an unauthenticated attacker with network access to cause denial of service or potentially execute arbitrary code by sending crafted network traffic.

CVE-2026-42831 is a heap-based buffer overflow vulnerability in Microsoft Office, allowing a local attacker to execute arbitrary code with a CVSS score of 7.8.

CVE-2026-40407 is a heap-based buffer overflow vulnerability in the Windows Common Log File System (CLFS) Driver, enabling a locally authenticated attacker to escalate privileges on the system.

CVE-2026-40403 is a heap-based buffer overflow vulnerability in Windows Win32K - GRFX that allows an authorized local attacker to execute arbitrary code, potentially leading to privilege escalation and code execution.

CVE-2026-35421 is a heap-based buffer overflow vulnerability in Windows Graphics Device Interface (GDI) that allows an unauthorized attacker to execute arbitrary code locally with elevated privileges.

CVE-2026-34329 is a heap-based buffer overflow in Windows Message Queuing, enabling an unauthenticated attacker on an adjacent network to achieve remote code execution.

barebox versions prior to 2026.04.0 are vulnerable to memory-safety issues in the EFI PE loader (CVE-2026-34963), potentially allowing code execution via malicious EFI PE binaries.

A heap buffer overflow vulnerability in BusyBox's DHCPv6 client allows network-adjacent attackers to trigger memory corruption, denial of service, or arbitrary code execution via crafted DHCPv6 responses.

A heap buffer overflow vulnerability exists in the WebRTC component of Google Chrome and Microsoft Edge (Chromium-based), potentially leading to code execution.

CVE-2026-7353 is a heap buffer overflow vulnerability in the Skia graphics library used by Chromium, affecting both Google Chrome and Microsoft Edge.

A heap buffer overflow vulnerability exists in NTFS-3G versions 2022.10.3 before 2026.2.25 that allows for heap memory corruption by processing a crafted NTFS image with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.

Creolabs Gravity before 0.9.6 is vulnerable to a heap buffer overflow in the gravity_vm_exec function, allowing attackers to achieve arbitrary code execution by crafting scripts with many string literals at global scope that exploit insufficient bounds checking in gravity_fiber_reassign().

Adobe InDesign versions 20.5.2, 21.2 and earlier are vulnerable to a heap-based buffer overflow (CVE-2026-34629) that could lead to arbitrary code execution if a user opens a malicious file.

CVE-2026-32087 is a heap-based buffer overflow vulnerability in the Function Discovery Service (fdwsd.dll) that allows an authorized local attacker to elevate privileges on a Windows system.

CVE-2026-22828 is a heap-based buffer overflow in Fortinet FortiAnalyzer and FortiManager Cloud versions 7.6.2 through 7.6.4, potentially allowing a remote unauthenticated attacker to execute arbitrary code with a significant preparation effort due to ASLR and network segmentation.

A heap out-of-bounds write vulnerability exists in OpenEXR's DWA lossy decoder due to integer overflow during block pointer calculation, triggered via crafted DWAA files, leading to crashes during DCT execution.

A heap-based buffer overflow vulnerability (CVE-2026-24660) exists in the x3f_load_huffman functionality of LibRaw commit d20315b, where a specially crafted malicious file can lead to a heap buffer overflow.

A memory corruption vulnerability (CVE-2026-21372) exists when processing IOCTL requests with invalid buffer sizes leading to a heap-based buffer overflow, reported by Qualcomm with a CVSS v3.1 score of 7.8.

A heap overflow vulnerability in the HiLCOS web interface of Hirschmann Industrial IT products (CVE-2024-14033) allows unauthenticated remote attackers to cause a denial-of-service condition by sending specially crafted requests, leading to device crashes and service disruption, particularly when the Public Spot functionality is enabled.

A remote attacker can exploit a heap buffer overflow vulnerability (CVE-2026-4673) in Google Chrome's WebAudio component before version 146.0.7680.165 by crafting a malicious HTML page, potentially leading to an out-of-bounds memory write and arbitrary code execution.

An unpatched vulnerability in QEMU's virtio-snd component allows for a hypervisor escape due to an uncontrolled heap overflow.

CVE-2026-41445 is a reported integer overflow vulnerability in the KissFFT library that could lead to a heap buffer overflow.

The SAIL library versions before commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302 are vulnerable to a heap overflow in the TGA codec's RLE decoder, where the raw-packet path lacks bounds checking, potentially leading to privilege escalation via crafted image files.

A heap buffer overflow vulnerability exists in the SAIL image loading library's PSD codec due to a mismatch in bytes-per-pixel calculation and pixel buffer allocation in LAB mode, leading to potential code execution.

CVE-2023-21716 is a critical heap-based buffer overflow vulnerability in Microsoft Word 2016's RTF parser, triggered by a malformed RTF file, leading to remote code execution on Windows 7.

A heap buffer overflow vulnerability, CVE-2026-33846, exists in the DTLS handshake fragment reassembly logic of GnuTLS, allowing unauthenticated remote attackers to cause application crashes or potential memory corruption by sending crafted DTLS fragments with conflicting message lengths.