Heap Overflow

Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal network to crash the openNDS daemon and potentially execute arbitrary code remotely. The flaw is in the redirect_to_splashpage function in http_microhttpd.c, where the query string buffer is under-allocated at QUERYMAXLEN bytes despite URL encoding expanding input by up to 1.5x - when a crafted request triggers the redirect path, the encoded data overflows the heap allocation. No public exploit identified at time of analysis, though the upstream fix commit is publicly available and exposes the exact vulnerable code path.

Remote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key management) process, letting a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to an affected Firebox firewall. The vendor-assigned CVSS 4.0 base score is 9.3 (critical), reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the pre-authentication nature and the perimeter role of the affected device make this a high-priority patching item.

Heap-based buffer overflow in WatchGuard Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon by saving a specially crafted configuration, resulting in denial of service and disruption of IPsec VPN services. The CVSS 4.0 score of 6.9 with PR:H reflects the high-privilege requirement, meaning exploitation is gated behind valid administrator credentials. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis.

Heap-based buffer overflow in Adobe Substance 3D Sampler versions 5.1.3 and earlier enables arbitrary code execution at the privilege level of the current user when a crafted file is opened. The vulnerability stems from improper bounds checking during file parsing (CWE-122), allowing a heap memory region to be overwritten with attacker-controlled data. No public exploit code has been identified at time of analysis and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, but the file-based delivery vector makes it well-suited to phishing or watering-hole campaigns targeting 3D content creators.

Heap-based buffer overflow in the Dia diagram editor's WPG file importer allows arbitrary code execution or process crash when a user opens a crafted WPG file. The WPG color palette buffer is allocated for exactly 256 entries (768 bytes), but the COLORMAP record parser fails to validate that the supplied start index (i16) or total entry count (iNum16) stay within that bound, allowing a malicious file to drive fread() to write beyond the heap allocation. Affecting all Dia versions on the upstream master branch through at least 2026-08-21, no public exploit or patch version has been confirmed at time of analysis, though the description provides sufficient detail to construct proof-of-concept input.

Remote code execution in Ubiquiti EdgeMAX EdgeSwitch devices allows an attacker on an adjacent network to fully compromise the switch by exploiting a heap-based buffer overflow in its DHCPv6 handling. The flaw affects EdgeSwitch units that have DHCPv6 enabled and requires no authentication or user interaction, only Layer 2/link-local reachability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.6 rating and network-daemon attack surface make it a high-priority patching target.

Heap-based buffer overflow in FreeBSD's ppp(8) daemon allows a malicious PPP peer to crash the daemon or execute arbitrary code as root. The flaw resides in mp_Enddisc(), which miscalculates buffer lengths when formatting Multilink PPP endpoint discriminator addresses, overflowing a global result buffer. Affected releases are FreeBSD 14.4-RELEASE prior to p9, 15.0-RELEASE prior to p13, and 15.1-RELEASE prior to p3; no active exploitation is confirmed (not in CISA KEV), but SSVC rates the technical impact as total and the attack as automatable.

Heap buffer overflow in Google Chrome's Media component prior to version 152.0.7977.65 enables remote code execution inside the renderer sandbox when a user visits a crafted HTML page. The CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U) reflects low attack complexity and no authentication requirement, but the unchanged scope (S:U) confirms execution is sandboxed - a full system compromise would require a separate sandbox escape not described in this CVE. No public exploit code has been identified and no CISA KEV listing exists; EPSS of 0.28% (20th percentile) indicates low observed exploitation activity, which is consistent with a patch-and-monitor posture rather than emergency response.

Heap-based buffer overflow in Google Chrome's WebRTC component (versions prior to 152.0.7977.65) enables a remote attacker to execute arbitrary code inside the Chrome renderer sandbox by delivering a crafted HTML page to a victim user. The CVSS score of 8.8 reflects broad impact (C:H/I:H/A:H) with no authentication prerequisite, though code execution is initially sandboxed and scope is unchanged (S:U). No public exploit code has been identified at time of analysis; SSVC records exploitation status as none and EPSS probability is low at 0.28% (20th percentile), suggesting this has not yet been leveraged at scale despite the high-severity rating.

Heap-based buffer overflow (CWE-122) in Blink, Chrome's rendering engine, grants native code execution within the renderer sandbox to attackers who have already achieved renderer process compromise, affecting all Chrome versions prior to 152.0.7977.65 across all platforms. The fix is confirmed in stable channel release 152.0.7977.65. No public exploit identified at time of analysis; EPSS at 0.28% (20th percentile) and Chromium's own Medium severity rating both reflect the high attack complexity imposed by the mandatory prior-renderer-compromise precondition.

Remote code execution in Google Chrome desktop before 152.0.7977.65 stems from a heap buffer overflow in the WebGL component, and critically allows an attacker to execute code OUTSIDE the renderer sandbox (scope change) via a single crafted HTML page. Any user who browses to a malicious or compromised site is at risk, requiring only that the page load and render WebGL content. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.39%), but the sandbox-escape impact and network reachability make this a high-priority patch.

Heap-based buffer overflow in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome for Android prior to 152.0.7977.65 enables remote code execution outside the renderer sandbox via a crafted HTML page, meaning a successful attacker escapes Chrome's process isolation boundary with full C/I/A impact. Exploitation requires no authentication and only that a victim navigate to an attacker-controlled page, making drive-by compromise via phishing or malvertising a realistic delivery path. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though the sandbox-escape capability significantly elevates real-world priority beyond what the raw CVSS score alone conveys.

Remote code execution outside the browser sandbox affects Google Chrome desktop builds prior to 152.0.7977.65, stemming from a heap buffer overflow in the ANGLE graphics translation layer. A remote attacker who lures a victim into loading a crafted HTML page can execute arbitrary code that escapes the renderer sandbox (CVSS 9.6, scope-changed). No public exploit identified at time of analysis, and EPSS is low (0.28%, 20th percentile), but the sandbox-escape impact and universal Chrome deployment make patching urgent.

Heap buffer overflow in PyOpenEXR Python bindings versions 3.3.0-3.3.12 and 3.4.0-3.4.13 causes memory corruption and process crash when opening a crafted deep scanline EXR file. A specific channel naming collision - a literal channel 'left' coexisting with layer-prefixed 'left.R', 'left.G', 'left.B' - causes the wrapper to allocate scalar-shaped deep sample storage and then write into it at RGB stride (three lanes), overflowing the heap allocation. No public exploit or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 3.3.13 and 3.4.14.

Heap out-of-bounds write in OpenEXR's exrmultiview utility allows an attacker who can supply crafted EXR files to corrupt heap memory when the tool combines two individually valid scanline EXR files whose union dataWindow is misaligned to one view's channel subsampling. Affected are OpenEXR versions across three maintained branches (pre-3.2.11, 3.3.0-3.3.12, and 3.4.0-3.4.13), all fixed in their respective patch releases. No public exploit or CISA KEV listing has been identified at time of analysis, though the attack is achievable via normal command-line invocation with attacker-supplied files in VFX pipeline contexts.

Heap buffer overflow in PyOpenEXR versions 3.3.0-3.3.12 and 3.4.0-3.4.13 allows an attacker to corrupt process memory by supplying a crafted EXR image file containing conflicting literal and prefixed RGB channel names. When the Python wrapper decodes such a file under the default separate_channels=False mode, a channel-name key collision causes the coalescing logic to reuse an undersized NumPy array and write pixel data out of bounds on the heap, producing high integrity and availability impact with no confidentiality exposure. No public exploit code has been identified and no active exploitation is confirmed; patched releases 3.3.13 and 3.4.14 are available from the Academy Software Foundation.

Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution under the logged-in user's context when a victim opens a specially crafted malicious file. The vulnerability (CWE-122) affects all tracked versions per the wildcard CPE, with Adobe acknowledging the issue via advisory APSB26-129. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution within the context of the current user when a victim opens a specially crafted malicious file. The CVSS 7.8 (High) score reflects local attack vector with no required privileges but mandatory user interaction, making social engineering the primary delivery mechanism for exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the high-impact C:H/I:H/A:H triad and RCE potential make patching a priority for affected creative industry environments.

Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution in the context of the current user when a victim opens a specially crafted file. The flaw (CWE-122) arises during malicious file parsing, covering all versions per the wildcard CPE. Adobe has published advisory APSB26-129. No public exploit or CISA KEV listing has been identified at time of analysis, but the High CVSS score and full CIA triad impact make this a meaningful risk for creative and game-development environments.

Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution at the privilege level of the victim user when a maliciously crafted file is opened. All versions are affected per the wildcard CPE, and Adobe has published advisory APSB26-129 addressing this issue. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the file-open attack vector makes this highly amenable to phishing and supply-chain-style delivery.

Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted malicious file. The attack surface is local - an attacker must deliver and persuade a target to open a weaponized file, a pattern consistent with spear-phishing or watering-hole distribution targeting creative professionals. No public exploit code or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the victim user when a malicious file is opened. The vulnerability carries a CVSS 7.8 (High) rating with full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit code or active exploitation has been identified at time of analysis; however, the file-open trigger and broad version coverage (all versions per CPE) make this a credible threat to creative professionals using the software.

Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the authenticated local user when a victim opens a specially crafted malicious file. The vulnerability carries a CVSS 3.1 score of 7.8 (High), with full confidentiality, integrity, and availability impact on the affected system. No public exploit code or active exploitation has been identified at time of analysis, though the file-parsing attack surface is a well-understood target for threat actors.

Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution under the privileges of the current user when a victim opens a crafted malicious file. The vulnerability is rooted in CWE-122 (Heap-based Buffer Overflow), a memory corruption class that reliably yields code execution primitives in native applications. No public exploit code or active exploitation has been identified at time of analysis; however, the high CVSS score (7.8) and confirmed arbitrary code execution impact make this a meaningful risk for users in creative and 3D content production pipelines.

Heap-based buffer overflow in Adobe Substance 3D Designer enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted malicious file. The flaw (CWE-122) resides in the application's file parsing subsystem, where insufficient bounds validation permits heap memory corruption that an attacker can leverage to redirect execution flow. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the full confidentiality, integrity, and availability impact paired with low attack complexity post-file-open reflects meaningful severity for creative professionals operating in shared-asset workflows.

Heap-based buffer overflow in Adobe Substance 3D Designer enables arbitrary code execution in the context of the current user when a malicious file is opened. The flaw (CWE-122) resides in the application's file parsing logic, allowing an attacker who can deliver a crafted Designer file to achieve full code execution without requiring any elevated privileges on the target system. No public exploit has been identified at time of analysis, and Adobe has issued a remediation advisory under APSB26-115.

Heap-based buffer overflow in Adobe Substance 3D Designer allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. The vulnerability, tracked under CWE-122, resides in the application's file-parsing logic and affects all versions per Adobe's advisory APSB26-115. No public exploit or KEV listing has been identified at time of analysis, but the file-delivery vector makes this highly suitable for spear-phishing campaigns targeting creative professionals.

Heap-based buffer overflow in Adobe Substance 3D Designer enables arbitrary code execution in the context of the victim user when a malicious project or asset file is opened. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms local file-based exploitation with no privileges required on the attacker side, but requiring the victim to actively open a crafted file. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor has issued advisory APSB26-115 addressing this issue.

Heap-based buffer overflow in Adobe Substance 3D Designer enables arbitrary code execution scoped to the victim's user account when a crafted file is opened. The CWE-122 flaw carries a CVSS 7.8 (High) rating with full confidentiality, integrity, and availability impact, making successful exploitation highly damaging despite the required file-open interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity once file delivery is achieved keeps this a credible threat to creative professionals.

Heap out-of-bounds write in OpenEXR 3.3.0-3.3.12 and 3.4.0-3.4.13 allows an attacker who can supply a crafted deep scanline EXR file to crash the exrmetrics utility or potentially execute arbitrary code when pixel conversion options are active. The flaw arises from a HALF/FLOAT element-size mismatch: sample buffers are allocated for 2-byte HALF input while DeepSlice writes 4-byte FLOAT output, overrunning the heap. No public exploit or active exploitation has been identified at time of analysis; fixed releases 3.3.13 and 3.4.14 are available.

Heap out-of-bounds write in OpenEXR's TiledRgbaInputFile RGBA API affects all three active release lines on 32-bit/ILP32 builds, allowing a remote attacker to deliver a crafted EXR file that crashes or corrupts the heap of any application that opens it. The root cause is a 32-bit integer overflow in the Array2D<Rgba> buffer size calculation when tile dimensions (65537×65537) are encoded in the file header but the actual dataWindow is tiny (40×40), causing the allocator to produce an undersized buffer that tile decode then overflows. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor-released patches are available across all three affected release branches.

Remote code execution in Konami's Metal Gear Online 3 (build 1.1.2.8) arises from an unbounded heap write when parsing the lobby's kicked-player list: the game trusts the attacker-supplied "kick_num" count without checking it against the 16-player buffer limit. A malicious lobby participant can overflow the kicked-ID buffer into adjacent Steam callback handler structures, corrupting function pointers to hijack control flow and potentially execute arbitrary code inside the game process. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the network-reachable, unauthenticated nature and RCE potential make it high-severity.

Heap-based buffer overflow in luci-lib-px5g's native ASN.1 encoding routine allows a locally authenticated attacker to write one byte beyond a heap-allocated buffer during certificate signing, with a high availability impact and limited confidentiality and integrity exposure. The flaw is triggered specifically when signing with a 2040-bit RSA key via the exported Lua interface create_selfsigned(), where a DER length encoding miscalculation causes an allocation of 259 bytes for a payload requiring 260. Remote exploitability is not confirmed - it depends entirely on whether the embedding application exposes this interface externally. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Heap out-of-bounds write in LibVNCClient 0.9.12-0.9.15 allows a malicious or man-in-the-middle VNC server to corrupt client heap memory with attacker-controlled data, leading to unconditional denial of service or demonstrated remote code execution via callback pointer overwrite. The flaw fires from a single FramebufferUpdate message the moment a victim connects, requires no authentication, and works against default builds with default settings. No public exploit has been identified at time of analysis, though the GitHub Security Advisory explicitly demonstrates code execution under default configuration.

Heap buffer overflow in Capstone's SuperH (SH) architecture floating-point disassembler affects all releases through 6.0.0-Alpha9, allowing a four-byte out-of-bounds write into heap memory when processing crafted SH instructions. The root cause is that opFADD, opFMUL, opFSUB, and related SH FPU decoders in arch/SH/SHDisassembler.c increment op_count as an array index into the fixed-size operands[] array without bounds checking, overflowing the 176-byte sh_info heap allocation. A process that disassembles attacker-controlled SH binary data with the affected mode flags can be crashed; code execution is possible but depends on heap layout. No public exploit has been identified at time of analysis, though a proof-of-concept test case is included in the upstream fix PR. The vendor-released patch is version 6.0.0-Alpha10.

Heap buffer overflow in libvips prior to 8.18.3 allows up to 4032 bytes to be written beyond an allocated heap buffer during processing of untrusted uncompressed PPM images via custom source objects, potentially causing memory corruption or a process crash. The flaw exists specifically in vips_source_read_to_memory in libvips/iofuncs/source.c, where VIPS_MAX was used instead of VIPS_MIN when computing the remaining read size. No public exploit code exists and this is not listed in CISA KEV; the CVSS 4.0 score of 5.8 reflects meaningful constraints including local attack vector, high complexity, and a prerequisite of non-default custom source configuration.

Heap out-of-bounds read in libvips before 8.18.3 leaks four bytes of adjacent heap memory when parsing a crafted Radiance HDR image whose first scanline begins with an RLE repeat marker. The old-style decoder in `scanline_read_old` dereferences `q[-1]` without confirming a prior pixel exists, disclosing data most likely belonging to adjacent image buffers. No public exploit or active exploitation has been identified; the fix is confirmed in the v8.18.3 release.

Integer overflow in libvips prior to 8.18.3 allows an attacker who can supply a crafted many-band TIFF image to evade scanline validation in VipsForeignLoadTiff, producing heap-region miscalculations that enable reads or writes at attacker-controlled negative offsets within mmap-resident allocations. Affected deployments include any pipeline - web applications, batch processors, or CLI tools - that pass untrusted TIFF input through libvips, with confirmed impacts of data disclosure via uncompressed .v output and near-certain process crashes; remote code execution has not been demonstrated but is explicitly not ruled out by the vendor. No public exploit or CISA KEV listing exists at time of analysis; the upstream fix is confirmed in v8.18.3.

Remote code execution outside Chrome's sandbox via a heap-based buffer overflow in the Network component affects Google Chrome prior to 151.0.7922.173. An unauthenticated remote attacker can trigger the flaw by directing a target user to a crafted HTML page, achieving arbitrary code execution that escapes Chrome's sandbox boundary with full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit has been identified at time of analysis, and EPSS signals low current exploitation probability (0.39%, 32nd percentile); however, the sandbox-escape characteristic elevates the strategic patching priority beyond what the EPSS alone would suggest.

Heap-based buffer overflow in GIMP's TIF file parser enables remote code execution when a user opens a crafted TIFF image, affecting GIMP 3.2.2. The flaw stems from missing length validation before copying attacker-controlled data into a heap buffer (CWE-122), granting full code execution in the context of the GIMP process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a fix commit is available on the GNOME GitLab repository.

Heap-based buffer overflow in GIMP's TIF file parser (CWE-122) enables remote code execution on affected installations when a user opens a crafted TIFF image. Confirmed affected version is GIMP 3.2.2 per EUVD-2026-63451, with the flaw originating from missing length validation before copying attacker-controlled data to a heap buffer. Discovered and reported by Zero Day Initiative (ZDI-26-455 / ZDI-CAN-29398); no public exploit or CISA KEV listing has been identified at time of analysis, though an upstream patch commit exists on GNOME GitLab.

Heap-based buffer overflow in GStreamer's PNG file parsing allows remote code execution in the context of the affected process. Affects GStreamer installations where a user can be induced to open or process a maliciously crafted PNG file - via a web page or file download. The flaw stems from missing length validation before copying attacker-controlled data into a heap buffer (CWE-122). No public exploit or CISA KEV listing is identified at time of analysis; however, ZDI disclosed the issue under ZDI-26-466 following coordinated disclosure, and GStreamer has issued security advisory sa-2026-0052.

Heap-based buffer overflow in GStreamer's MRF file parser enables remote code execution when a user opens a crafted media file or visits a page that triggers parsing. The root cause is absent length validation before copying attacker-supplied data into a heap buffer (CWE-122), granting full confidentiality, integrity, and availability impact within the target process. Reported by ZDI as ZDI-CAN-29608 and addressed in GStreamer security advisory SA-2026-0050; no public exploit code or CISA KEV listing is confirmed at time of analysis.

Remote code execution in the Sony XAV-9500ES automotive multimedia head unit is achievable by a network-adjacent attacker who can induce a victim to pair a malicious Bluetooth device. The root cause is a heap-based buffer overflow (CWE-122) in the AVRCP_Br_Response_Parser function, which fails to validate the length of attacker-controlled data before copying it into a heap allocation. Successful exploitation yields arbitrary code execution at the device level; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Heap-based buffer overflow in the Sony XAV-9500ES car multimedia receiver's Bluetooth L2CAP SDU reassembly function enables network-adjacent attackers to execute arbitrary code on the device. The flaw in `l2_reassemble_sdu` stems from missing length validation before copying attacker-controlled data to a heap buffer, granting full code execution in the device context once a malicious Bluetooth device has been paired by the victim. No public exploit or CISA KEV listing has been identified at time of analysis, but the ZDI advisory (ZDI-26-474) and a Sony firmware update advisory are both publicly available.

Heap-based buffer overflow in the vCardParser class of the Kenwood DNR1007XR automotive multimedia receiver allows physically present, unauthenticated attackers to execute arbitrary code with root privileges. The flaw stems from missing bounds validation when copying attacker-controlled string data into a heap-allocated buffer during vCard contact parsing. No public exploit code or active exploitation has been identified at time of analysis; ZDI tracked this internally as ZDI-CAN-28974 and issued advisory ZDI-26-488.

Denial of service via heap-based buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, exploitable by remote unauthenticated attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this a low-friction remote availability attack against IBM Power Systems infrastructure. No active exploitation or public exploit code has been identified at time of analysis; a vendor patch is available via IBM's support portal.

Heap-based buffer overflow in Wireshark's SSH protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, crashing the application and causing denial of service. An attacker delivers a crafted network capture file or malformed live SSH traffic; when a user opens or captures it with an affected Wireshark build, the dissector overflows a heap buffer and terminates the process. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Heap-based buffer overflow in Wireshark's Bluetooth AVRCP protocol dissector crashes the application when processing malformed AVRCP packets, enabling denial of service against versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The CVSS vector (AV:L/UI:R) indicates the attack requires a user to open or process a crafted packet capture file - this is not a remotely triggerable crash but a file-based DoS vector typical of Wireshark dissector flaws. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Heap-based buffer overflow in Wireshark's UMTS FP protocol dissector crashes the application across affected 4.4.x and 4.6.x releases, enabling denial of service against network analysts and security teams. Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7 are vulnerable when a user opens a specially crafted capture file or captures live traffic containing a malformed UMTS FP frame. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available in versions 4.6.8 and 4.4.18.

Heap-based buffer overflow in Wireshark's RDP protocol dissector (CWE-122) crashes the application when processing malformed RDP traffic, causing denial of service across two active release branches. Affected versions span 4.4.0-4.4.17 and 4.6.0-4.6.7 of the Wireshark Foundation's Wireshark (CPE: cpe:2.3:a:wireshark_foundation:wireshark). A proof-of-concept exists per SSVC data, though EPSS (0.17%, 7th percentile) and SSVC's 'Automatable: no' assessment indicate real-world mass exploitation is not occurring; no public exploit identified at time of analysis beyond the poc designation, and the flaw is absent from CISA KEV.

Wireshark's dissection engine in versions 4.4.0-4.4.17 and 4.6.0-4.6.7 contains a heap-based buffer overflow (CWE-122) that crashes the application when processing a specially crafted malformed packet, yielding a denial-of-service outcome. Exploitation requires that an analyst actively opens a malicious capture file or performs live capture of adversary-controlled traffic, making this a user-interaction-dependent, high-complexity flaw with no code execution potential. No active exploitation has been confirmed by CISA KEV, no public proof-of-concept has been identified, and the CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained real-world impact.

Denial of service in Wireshark's C12.22 protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, where a malformed C12.22 packet triggers a heap buffer overflow (CWE-122) that crashes the application. An attacker who can get crafted traffic in front of a capturing or file-loading analyst can reliably terminate the dissection session. A proof-of-concept is reported via SSVC, but there is no evidence of active exploitation, and the EPSS probability is low (0.27%).

Denial of service in Wireshark's Catapult DCT2000 file parser crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.17 when a malformed capture file is opened. The root cause is a heap-based buffer overflow (CWE-122) that exhausts availability without yielding code execution, as confirmed by the CVSS A:H, C:N, I:N profile. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, placing it in the moderate-priority tier despite the memory safety class of the flaw.

Heap-based buffer overflow in IBM i 7.3 through 7.6 allows a remote, low-privileged authenticated attacker to overwrite adjacent memory regions by triggering an integer underflow in the bounds checking logic. The CVSS scope change (S:C) reflects that the overwrite can cross component boundaries, though direct impact is rated low integrity only with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing are identified at time of analysis; a vendor patch is available.

Heap-based buffer overflow in the RTSP service of TP-Link Tapo C100 and C101 V5 IP cameras allows an authenticated attacker on the same local network segment to crash the RTSP service and force a device reboot by sending specially crafted frames with oversized length values. Impact is limited to temporary denial-of-service; no confidentiality or integrity compromise is achievable. No public exploit code has been identified at time of analysis, and TP-Link has released firmware patches for affected devices.

Heap buffer overflow in FreeRDP's Opus audio codec path allows a malicious RDP server to corrupt client heap memory and potentially execute arbitrary code on any connecting client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled. The flaw in freerdp_dsp_decode_opus (versions prior to 3.28.0) stems from a capacity check applied to the wrong buffer, leaving the actual PCM output buffer unguarded against oversized libopus decoded frames that can overrun the fixed 4096-byte StreamPool_Take destination in the rdpsnd channel. No public exploit has been identified at time of analysis, but the confirmed heap write primitive and RCE classification make this a credible code execution risk for susceptible client builds connecting to untrusted servers.

Heap buffer overflow in FFmpeg's VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) enables memory corruption via crafted Dirac data units across all versions prior to fix commit 1cdeb3c. The packetizer accepts an attacker-controlled data unit or fragment size and copies it into a fixed-size heap buffer without an upper-bound check, a classic CWE-122 condition with High confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; an upstream fix commit is available from the FFmpeg repository.

Heap buffer overflow in FFmpeg's RIST protocol reader (libavformat/librist.c) lets a remote RIST sender corrupt heap memory in any FFmpeg instance ingesting an async:rist:// stream, enabling potential remote code execution or crash. The librist_read() function ignores the caller's buffer size and copies the entire received RIST payload into a destination buffer that the async wrapper sizes smaller than the packet, so an oversized payload writes past the buffer end. Reported by VulnCheck and fixed upstream in commit 1c10bcc; no public exploit is identified at time of analysis and it is not listed in CISA KEV.

Heap buffer overflow in FFmpeg's hvcC box writer exposes any version prior to commit acf5d7c to memory corruption during HEVC muxing. When a crafted HEVC file presents more NAL units of a single type than the count field can encode, integer overflow corrupts heap memory, potentially enabling arbitrary code execution in the FFmpeg process context. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but server-side transcoding pipelines ingesting untrusted HEVC content effectively elevate the local-vector risk to a network-reachable attack surface.

Heap buffer overflows in FreeBSD's iconv(3) character-conversion library allow attackers who control input processed through the HZ, UTF-7, VIQR, or ZW encoding modules to corrupt heap memory, potentially leading to remote code execution. Applications on FreeBSD 14.3/14.4/15.0/15.1 that pass untrusted data through iconv using any of these encodings are exposed. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.21%, 12th percentile) despite the 9.8 CVSS.

Kernel memory corruption in FreeBSD's ZFS subsystem allows a local user with the delegated 'receive' ZFS permission to trigger a heap-based buffer overflow via the ZFS_IOC_RECV_NEW ioctl. The flaw stems from an integer truncation: a 64-bit payload size is silently narrowed to 32 bits for heap allocation, but the original 64-bit value is then used as the length for a subsequent byteswap operation - writing beyond the allocated buffer into kernel memory. Exploitation is limited to the heal receive path and requires the ZFS 'receive' delegation, but no patch has been publicly released yet for all affected branches. No public exploit code or CISA KEV listing has been identified at time of analysis.

Kernel heap overflow in FreeBSD's ZFS subsystem via the ZFS_IOC_USERSPACE_MANY ioctl enables local privilege escalation across multiple supported FreeBSD release branches. The flaw stems from an integer width mismatch: the kernel allocates a heap buffer sized by a 32-bit truncation of the caller-supplied 64-bit length, then copies records up to the original 64-bit limit - writing past the end of the allocation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and high impact across confidentiality, integrity, and availability make patching a priority for any FreeBSD deployment that uses ZFS delegated permissions.

Sandbox escape via heap-based buffer overflow in ANGLE's graphics engine on Chrome for Android allows a threat actor who has already achieved renderer process compromise to execute arbitrary code entirely outside the Chrome sandbox. All Chrome for Android versions prior to 151.0.7922.169 are affected; the vulnerability requires a two-stage exploit chain combining a separate renderer compromise with this ANGLE flaw. Google has released a patched build (151.0.7922.169); no public exploit code or CISA KEV listing has been identified at time of analysis, though the two-stage nature indicates likely use in sophisticated targeted attack chains.

Remote code execution in Google Chrome for Android before 151.0.7922.169 stems from a heap buffer overflow in Dawn, Chromium's WebGPU implementation, and is notable because Google explicitly states it allows code execution OUTSIDE the renderer sandbox. A remote attacker who lures a victim to a crafted HTML page can achieve full compromise of the browser process context on the device. Rated Critical by Chromium with CVSS 9.6; a vendor patch is available, and no public exploit has been identified at time of analysis.

Heap-based buffer overflow in Google Chrome's WebGL implementation (all versions prior to 151.0.7922.169) enables a remote attacker to execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. The sandbox escape elevates the impact from renderer-level code execution to potential full OS-level compromise. No public exploit code or active exploitation has been identified at the time of analysis, but the SSVC technical impact rating is 'total,' reflecting the severity of successful exploitation.

Heap-based buffer overflow in Open5GS v.2.7.0 allows remote unauthenticated attackers to crash the NAS 5GS decoder chain by sending a NAS PDU with a mutated message type byte, resulting in denial of service to the AMF component and all connected UEs. The vulnerability is network-accessible with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), making it trivially reachable from any host with access to the AMF N1 interface. A public proof-of-concept exploit exists, no public exploit identified as confirmed active exploitation (no CISA KEV listing), and no vendor patch has been confirmed at time of analysis.

Remote code execution in Systerel S2OPC 1.7.3 arises from a heap out-of-bounds write in the server-side EventFilter handling path exercised during CreateMonitoredItems processing. A remote attacker who can reach the OPC UA server endpoint and open a session on an events-enabled server can corrupt heap memory to achieve arbitrary code execution with the privileges of the server process. No public exploit identified at time of analysis, and EPSS is low (0.27%, 20th percentile), indicating the CVSS 9.8 rating reflects potential impact rather than observed mass exploitation.

Heap buffer overflow in hashcat's KeePass AESKDF/KDBX v4 cracking module (module_34301.c) exposes master branch builds after v7.1.2 to heap memory corruption when a privileged operator processes a crafted hash file containing an oversized ninth token field. The parser accepted up to 600 hex characters for a field decoded into a fixed 256-byte buffer with no length check, enabling up to 44 bytes of out-of-bounds writes into adjacent esalt fields and heap chunk metadata. No public exploit exists and the vulnerability is not listed in CISA KEV; an upstream fix commit is confirmed available.

Heap-based buffer overflow in Open Asset Import Library (Assimp) at commit 17c12da allows remote attackers to corrupt heap memory by supplying a crafted MDL7 3DGS format file that triggers out-of-bounds writes in the AddBonesToNodeGraph_3DGS_MDL7 function via a manipulated bones_num argument. Any application embedding Assimp that accepts untrusted 3D model files is exposed, with no vendor patch released as the project has not responded to disclosure. A publicly available proof-of-concept exploit exists, meaningfully lowering the exploitation bar for opportunistic attackers.

Heap-based buffer overflow in Assimp's 3DGS MDL7 model parser allows remote attackers to crash applications processing maliciously crafted model files, causing a denial-of-service condition. The flaw resides in the ReadFaces_3DGS_MDL7 function and affects all Assimp versions through commit 17c12da (CPE wildcard-versioned), with a public proof-of-concept exploit already circulating on GitHub. No active exploitation is confirmed in CISA KEV; the CVSS 4.0 score of 5.3 (Medium) reflects availability-only impact gated by passive user interaction.

Heap-based buffer overflow in Open Asset Import Library (Assimp) commit 17c12da enables remote attackers to corrupt memory by supplying a crafted file processed by the decompressBlock routine in Compression.cpp. Any application embedding Assimp for 3D asset import is exposed when a user opens a malicious model file, making this a supply-chain-style risk across game engines, editors, and design tools that depend on the library. No vendor patch exists at time of analysis - the project was notified via GitHub issue #6624 but has not responded - and a public proof-of-concept archive has already been released, lowering the barrier to exploitation.

Remote code execution in Microsoft Edge (Chromium-based) is enabled by a heap-based buffer overflow (CWE-122) that network-accessible, unauthenticated attackers can trigger when a victim interacts with attacker-controlled content. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) reflects high confidentiality and integrity impact with low attack complexity, requiring only that the user visit or open a crafted resource. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Heap buffer overflow in PostgreSQL's pg_dump backup utility across all active major versions enables an authenticated database user with object creation privileges to execute arbitrary code as the operating system account running pg_dump. The attacker plants a crafted database object containing an excessively long function transform list, then waits for pg_dump to process that object during a backup operation, triggering CWE-122 heap corruption. No public exploit has been identified at time of analysis, but the clear trigger path and widely deployed target surface make this a meaningful operational risk for organizations relying on pg_dump for backup automation.

Heap buffer overflow in PostgreSQL's pg_stat_statements extension (major version 18, minor versions 18.0 through 18.4) allows any authenticated database user to execute arbitrary code as the operating system account running the PostgreSQL service by submitting crafted SQL queries containing array constants. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a valid database credential, with full confidentiality, integrity, and availability impact on the database host. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.

Heap buffer overflow in PostgreSQL's plperl extension allows a database function owner to execute arbitrary code as the OS-level user running the database server by crafting a function body that returns a tied hash. Affected versions span the four active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Heap buffer overflow in PostgreSQL's to_char(timestamptz) function allows any authenticated database user to execute arbitrary code as the operating system account running the database process by supplying an excessively long POSIX timezone abbreviation. Affected versions span the actively maintained major release lines: PostgreSQL 14 through 18, with fixes available in 14.24, 15.19, 16.15, 17.11, and 18.5. No public exploit code has been identified at time of analysis, but the low attack complexity and broad deployment surface of PostgreSQL make this a high-priority patching target for any environment where untrusted or semi-trusted database users exist.

Heap buffer overflow in PostgreSQL's regexp engine allows any authenticated database user to execute arbitrary code as the operating system user running the database process. The flaw is triggered by specially crafted text that survives input validation but undergoes unanticipated data growth during internal round-trip conversion through the pg_wchar encoding layer, overflowing a heap-allocated buffer during regular expression evaluation. All active PostgreSQL branches are affected - versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 - with no public exploit or CISA KEV listing confirmed at time of analysis.

Heap-based buffer overflow in the modbusgwd daemon on Teltonika Networks RUTOS devices allows unauthenticated attackers with adjacent network access to the Modbus TCP service to crash the gateway process, causing a denial of service. The flaw originates in modbusgwd's failure to properly validate incoming Modbus TCP request data before writing to heap-allocated memory, triggering memory corruption on receipt of a malformed frame. No public exploit code has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog, though the Modbus protocol's prevalence in OT and industrial environments makes availability disruption a meaningful operational risk.

Heap-based buffer overflow in Wireshark's TTX Logger file parser affects versions 4.6.0 through 4.6.7, causing application crashes and denial of service when a user opens a specially crafted TTX Logger file. The vulnerability is rooted in CWE-122 (Heap-based Buffer Overflow) and is classified as medium severity with a CVSS score of 4.7. No active exploitation has been identified at time of analysis, and exploitation requires local file access combined with user interaction, substantially limiting real-world exposure.

Heap-based buffer overflow in the MongoDB BI Connector ODBC Driver enables process memory disclosure, process termination, or arbitrary code execution when an application processes crafted stored procedure output parameter metadata returned by a malicious or impersonated database server. All versions prior to v1.4.9 are affected (CPE: cpe:2.3:a:mongodb:bi_connector_odbc_driver:*:*:*:*:*:*:*:*), and the attack does not require privileges against the driver itself, though the attacker must control or impersonate the upstream database server. MongoDB has released a patched version (v1.4.9) that adds buffer-clamping logic to prevent the overflow; no public exploit has been identified at time of analysis.

Heap out-of-bounds read and write in FreeRDP's Kerberos SSPI layer (all versions prior to 3.30.0) allows a malicious RDP peer to corrupt memory during CredSSP/NLA Kerberos decryption by supplying a crafted GSS Wrap-token with an unbounded EC or EC+RRC field value. The flaw sits in the pre-session authentication path, meaning exploitation does not require an established authenticated session from the attacker's side. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the network-reachable attack surface during a common enterprise authentication flow warrants prompt patching.

Remote code execution affects Microsoft Azure Attestation service and Device Health Attestation Service via an integer overflow condition that leads to a heap-based buffer overflow (CWE-122). Unauthenticated network attackers can exploit this flaw - confirmed by PR:N in the CVSS vector - though the high attack complexity (AC:H) indicates precise exploitation conditions must be met. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential impact is critical: full compromise of confidentiality, integrity, and availability on the affected service.

Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.

Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.

Privilege escalation via heap-based buffer overflow in the Windows DNS component affects Windows 10, Windows 11, and Windows Server editions spanning Server 2012 through Server 2025. An authorized local attacker holding low-privilege credentials can trigger the overflow to achieve full system compromise (C:H/I:H/A:H). No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center advisory.

Heap-based buffer overflow in the Windows DNS component enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM across a broad range of Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The CVSS 3.1 score of 7.8 reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is obtained, with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available via the Microsoft Security Response Center.

Heap-based buffer overflow in Microsoft Office (365 Apps for Enterprise, Office 2019, Office 2021 LTSC, and Office 2024 LTSC) enables a local attacker with low-privilege credentials to execute arbitrary code with the full confidentiality, integrity, and availability impact of the Office process. The vulnerability (CWE-122) carries a CVSS 3.1 score of 7.8 and requires only local access and a standard user account - no user interaction is needed once the attacker can trigger the vulnerable allocation path. No public exploit code has been identified at time of analysis, and SSVC assessment confirms current exploitation status as none.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution with full system-level impact when a victim opens a specially crafted Excel file. The flaw (CWE-122) resides in Excel's file parsing logic, where malformed input causes a heap memory region to be overwritten, redirecting execution flow. No public exploit has been identified at time of analysis, and the vulnerability has not appeared in CISA's Known Exploited Vulnerabilities catalog, though the Microsoft Security Response Center has issued an advisory.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. The vulnerability triggers during file parsing, allowing an attacker who can deliver a malicious document to execute arbitrary code with the privileges of the logged-in user. No KEV listing or public exploit code has been identified at time of analysis, but the local-execution-via-document vector makes this a meaningful phishing and spear-phishing enabler.