Cyber Resilience

CWE · MITRE source

CWE-122Heap-based Buffer Overflow

Abstraction: Variant · CVEs in our corpus: 2,729

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Last updated: 22 August 2026 20:22 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 1 mapping(s) from 1 framework(s): CAPEC 1 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • ID.RA-01
  • PR.PS-02
  • PR.PS-06
  • SA-11 Developer Testing and Evaluation
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.4.1

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2015-3113 KEV 9.99.80.99942015-06-23
CVE-2019-3568 KEV 9.99.80.39172019-05-14
CVE-2023-27997 KEV 9.99.80.85692023-06-13
CVE-2024-38077 9.99.80.75372024-07-09
CVE-2024-38812 KEV 9.99.80.54572024-09-17
CVE-2021-26691 9.89.80.68292021-06-10
CVE-2022-35711 9.89.80.73492022-10-14
CVE-2024-12084 9.89.80.72062025-01-15
CVE-2024-10525 9.59.80.58552024-10-30
CVE-2020-16010 KEV 9.49.60.06412020-11-03
CVE-2009-3459 KEV 9.28.80.86582009-10-13
CVE-2021-21017 KEV 9.28.80.86332021-02-11
CVE-2020-6146 9.18.80.77052020-09-16
CVE-2021-28560 9.08.80.66922021-09-02
CVE-2022-35712 9.09.80.36752022-10-14
CVE-2024-24996 8.99.80.32242024-04-19
CVE-2025-47981 8.99.80.32232025-07-08
CVE-2023-21690 8.89.80.27532023-02-14
CVE-2024-4323 8.89.80.28312024-05-20
CVE-2020-25681 8.78.10.81192021-01-20
CVE-2023-21689 8.79.80.26502023-02-14
CVE-2020-25682 8.68.10.70752021-01-20
CVE-2023-21692 8.69.80.21242023-02-14
CVE-2026-47291 8.69.80.22752026-06-09
CVE-2019-5482 8.59.80.17942019-09-16