Weakness / #14
CWE-122: Heap-based buffer overflow in CISA KEV
Heap-based Buffer Overflow
Answer 33 KEV entries list CWE-122 (Heap-based buffer overflow) as of catalog 2026.09.23, 1.9% of the catalog and rank 14 of 185 weaknesses. The most affected vendor is Microsoft (12).
Data written past the end of a heap-allocated buffer corrupts adjacent memory.
- KEV entries
- 331.9% of catalog
- Vendors
- 13affected
- Ransomware: known
- 618.2%
- First added
- 2021-11-03
- Latest added
- 2026-09-22
VVendors
TAdditions by year
| Year | Added |
|---|---|
| 2021 | 10 |
| 2022 | 6 |
| 2023 | 6 |
| 2024 | 3 |
| 2025 | 5 |
| 2026 | 3 |
PProducts
| Product | Entries | Share |
|---|---|---|
| Microsoft Windows | 10 | 30.3% |
| Google Chromium V8 | 8 | 24.2% |
| F5 BIG-IP APM | 1 | 3% |
| Fortinet Multiple Products | 1 | 3% |
| VMware vCenter Server | 1 | 3% |
| Microsoft DWM Core Library | 1 | 3% |
| GNU GNU C Library | 1 | 3% |
| Netwrix Auditor | 1 | 3% |
EAll entries
Cite this
33 CISA KEV entries list CWE-122 (Heap-based buffer overflow), 1.9% of the catalog. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/cwe/cwe-122/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.