A heap overflow condition occurs when a buffer on the heap is overwritten beyond its allocated boundaries. This typically happens when memory allocated via routines like malloc is accessed with unchecked or excessive data.
CyStack analysis based on the official MITRE CWE source 4.20 (04/30/2026).
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Heap based overflows occur when untrusted input or mismanaged data writes exceed the boundaries of memory blocks allocated on the heap. Unlike stack overflows, heap overflows can corrupt allocator metadata, function pointers, or other heap managed structures, potentially enabling arbitrary code execution or program crashes. The vulnerability is tied to memory management routines and the security context of dynamic allocation, where exploitation often relies on corrupting data in the heap region and affecting the program's control flow or data integrity.
Abstraction: Variant. Structure: Simple. Likelihood of exploit: High. Introduction phase: Implementation. Terminology: Buffer overflow, heap. Platforms: Memory unsafe languages like C/C++. Related weakness characteristics include impact on availability, integrity, confidentiality, and access control when arbitrary code execution occurs.
Scope includes Availability, Integrity, Confidentiality, Access Control. Impacts include DoS via crash or restart, resource consumption, and memory or CPU waste. Arbitrary code execution can bypass protection mechanisms and modify memory, potentially undermining user data and security policies. In some cases, exploitation may subvert other security services by altering control flow or memory structures.
Availability
DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Integrity, Confidentiality, Availability, Access Control
Execute Unauthorized Code or Commands, Bypass Protection Mechanism, Modify Memory
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. Besides important user data, heap-based overflows can be used to overwrite function pointers that may be living in memory, pointing it to the attacker's code. Even in applications that do not explicitly use function pointers, the run-time will usually leave many in memory. For example, object methods in C++ are generally implemented using function pointers. Even in C programs, there is often a global offset table used by the underlying runtime.
Integrity, Confidentiality, Availability, Access Control, Other
Execute Unauthorized Code or Commands, Bypass Protection Mechanism, Other
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
Pre-design: Use a language or compiler that performs automatic bounds checking. Architecture and Design: Use an abstraction library to shield risky APIs. Operation/Build: Enable automatic overflow detection features in compilers or extensions (for example GS, FORTIFY_SOURCE, StackGuard, ProPolice, or D3-SFCV); while not complete, they provide canary-based or range checking. Operation/Build: Apply memory randomization techniques such as ASLR and PIE to hinder reliable code jumps. Implementation: Enforce bounds checking on inputs. Implementation: Prefer safe library functions and avoid dangerous ones like gets.
Fuzzing is highly effective for triggering crashes and memory corruption, and automated dynamic analysis with tools like AddressSanitizer can detect memory safety errors during compilation or runtime. These methods have limits, as crafted inputs may be needed to reach the vulnerable code and some detectors may report the error without explaining the underlying mistake.
Observed examples from the official record include chains of vulnerabilities such as: CVE-2025-46687 describing a heap overflow triggered by a length check failure in a Javascript engine, CVE-2021-43537 where a 64-bit to 32-bit cast can lead to heap memory corruption, CVE-2007-4268 involving signedness errors leading to heap overflow, CVE-2009-2523 where missing NULL termination causes heap overflow or buffer over-read, CVE-2021-29529 where bounds are derived from floating point rounding leading to heap overflow, and CVE-2010-1866 where integer overflow bypasses checks causing heap overflow.
These examples illustrate this CWE entry and are not an exhaustive list of related vulnerabilities.
CWE™ Program, operated by The MITRE Corporation. Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. CWE Terms of Use.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
en
