Heap-based Buffer Overflow
CWE-122: Heap-based Buffer Overflow
A heap-based buffer overflow is an out-of-bounds write into memory allocated dynamically on the heap, for example with malloc or new. There is no return address next to the buffer, so attackers instead corrupt neighbouring objects, function pointers, virtual tables, or allocator metadata to gain control. Heap overflows are common in media codecs, document parsers, and network stacks where buffer sizes are computed from untrusted length fields.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- An image decoder calculates a buffer size with an integer multiplication that overflows, allocates too little, then writes the full image into it.
- A messaging app's media parser trusts a frame length field and overwrites an adjacent object's function pointer.
- A network driver copies a packet into a heap buffer sized for the expected maximum, not the actual received length.
How to mitigate it
- Check arithmetic used to compute allocation sizes for integer overflow, and validate lengths before each copy.
- Use memory-safe languages or bounds-checked containers for parsing untrusted data.
- Use hardened allocators and platform mitigations such as ASLR, heap isolation, and memory tagging.
- Fuzz parsers with AddressSanitizer to catch heap overflows early in development.
Go deeper
Practice this topic
Test your knowledge of Heap-based Buffer Overflow with exam-style practice questions.