CWE-122Heap-based Buffer Overflow

Abstraction: Variant · CVEs in our corpus: 3,615

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Last updated: 16 October 2026 07:24 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

ID.RA-01
PR.PS-02
PR.PS-06
SA-11 Developer Testing and Evaluation

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V1.4.1

NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2015-3113` KEV	9.9	9.8	0.9981	2015-06-23
`CVE-2019-3568` KEV	9.9	9.8	0.3008	2019-05-14
`CVE-2022-35711`	9.9	9.8	0.7393	2022-10-14
`CVE-2023-27997` KEV	9.9	9.8	0.8569	2023-06-13
`CVE-2024-38077`	9.9	9.8	0.8423	2024-07-09
`CVE-2024-38812` KEV	9.9	9.8	0.5457	2024-09-17
`CVE-2026-94127` KEV	9.9	9.8	0.0223	2026-09-22
`CVE-2021-26691`	9.8	9.8	0.6829	2021-06-10
`CVE-2024-12084`	9.8	9.8	0.7206	2025-01-15
`CVE-2024-10525`	9.6	9.8	0.5922	2024-10-30
`CVE-2020-16010` KEV	9.4	9.6	0.0636	2020-11-03
`CVE-2009-3459` KEV	9.2	8.8	0.8658	2009-10-13
`CVE-2021-21017` KEV	9.2	8.8	0.8633	2021-02-11
`CVE-2020-6146`	9.1	8.8	0.7550	2020-09-16
`CVE-2025-47981`	9.1	9.8	0.4112	2025-07-08
`CVE-2021-28560`	9.0	8.8	0.6692	2021-09-02
`CVE-2022-35712`	9.0	9.8	0.3737	2022-10-14
`CVE-2024-24996`	8.9	9.8	0.3224	2024-04-19
`CVE-2023-21690`	8.8	9.8	0.2774	2023-02-14
`CVE-2024-4323`	8.8	9.8	0.2724	2024-05-20
`CVE-2020-25681`	8.7	8.1	0.8119	2021-01-20
`CVE-2023-21689`	8.7	9.8	0.2670	2023-02-14
`CVE-2025-25249` KEV	8.7	8.1	0.0380	2026-01-13
`CVE-2020-25682`	8.6	8.1	0.7075	2021-01-20
`CVE-2023-21692`	8.6	9.8	0.2140	2023-02-14