CWE-122: Heap-based Buffer Overflow

Description:
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Affected languages: Memory-Unsafe, C, C++
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-788, CWE-787

Consequences:
  - Availability: DoS: Crash, Exit, or Restart
  - Integrity: Execute Unauthorized Code or Commands
  - Integrity: Execute Unauthorized Code or Commands

Detection methods:
  - Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with rand
  - Automated Dynamic Analysis: Use tools that are integrated during
	     compilation to insert runtime error-checking mechanisms
	     related to memory safety errors, such as AddressSanitizer
	     (ASan) for C/C++ [REF-1518].

Mitigations:
  - Pre-design: Use a language or compiler that performs automatic bounds checking.
  - [Architecture and Design] Use an abstraction library to abstract away risky APIs. Not a complete solution.
  - [Operation] Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detectio
  - [Operation] Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.   
		   Examples include Address Space

Demonstrative examples:
While buffer overflow examples can be rather complex, it is possible to have very simple, yet still exploitable, heap-based buffer overflows:
The buffer is allocated heap memory with a fixed size, but there is no guarantee the string in argv[1] will not exceed this size and cause an overflow.
#define BUFSIZE 256 int main(int argc, char **argv) { char *buf; buf = (char *)malloc(sizeof(char)*BUFSIZE); strcpy(buf, argv[1]); }

This example applies an encoding procedure to an input string and stores it into a buffer.
The programmer attempts to encode the ampersand character in the user-controlled string, however the length of the string is validated before the encoding procedure is applied. Furthermore, the programmer assumes encoding expansion will only expand a given character by a factor of 4, while the encoding of the ampersand expands by 5. As a result, when the encoding procedure expands the string it is possible to overflow the destination buffer if the attacker provides a string of many ampersands.
char * copy_input(char *user_supplied_string){ 
                         int i, dst_index; char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE); if ( MAX_SIZE <= strlen(user_supplied_string) ){ die("user st

Real-world examples:
  - CVE-2025-46687: Chain: Javascript engine code does not perform a length check (CWE-1284) leading to integer overflow (CWE-190) causing allocation of smaller buffer than expected (CWE-131) resulting in a heap-based bu
  - CVE-2021-43537: Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit integer (CWE-681) and potentially leading to an integer overflow (CWE-190). If an integer overflow occurs, this can cau
  - CVE-2007-4268: Chain: integer signedness error (CWE-195) passes signed comparison, leading to heap overflow (CWE-122)
  - CVE-2009-2523: Chain: product does not handle when an input string is not NULL terminated (CWE-170), leading to buffer over-read (CWE-125) or heap-based buffer overflow (CWE-122).
  - CVE-2021-29529: Chain: machine-learning product can have a heap-based
	      buffer overflow (CWE-122) when some integer-oriented bounds are
	      calculated by using ceiling() and floor() on floating point values