CWE-122: Heap-based Buffer Overflow vulnerabilities

Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.

Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.

Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information locally.

Heap-based buffer overflow in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.

ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

A heap-based buffer overflow vulnerability exists in the run_utility() function of the entr utility. The issue arises from incorrect handling of buffer size calculations when copying command-line arguments, leading to out-of-bounds writes. This can cause memory corruption, process abort, and denial of service. The vulnerability affects entr versions up to and including 5.8 and was fixed in a later commit.

CVE-2026-18497 is a heap-based buffer overflow vulnerability in the nothings stb TrueType library (stb_truetype.h) up to version 1.26. It occurs in the stbtt__GetGlyphShapeTT() function when parsing malformed TrueType font files with manipulated endPtsOfContours values, causing out-of-bounds reads during glyph data parsing. This can lead to high-impact consequences such as application crashes or potential denial of service when loading or rendering fonts.

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max parameter without overflow validation, causing heap buffer allocation to wrap and allocate insufficient memory. Attackers can exploit this by providing a crafted n_seq_max value through a malicious model file or JNI call to trigger heap corruption and achieve denial of service or arbitrary code execution on Android applications using the LLaMA-Android binding.