MITRE
cwe.mitre.org › data › definitions › 122.html
CWE - CWE-122: Heap-based Buffer Overflow (4.20)
Common Weakness Enumeration (CWE) is a list of software weaknesses.
type of buffer overflow
Automox
automox.com › blog › vulnerability-definition-heap-buffer
What is Heap Buffer Overflow Vulnerability?
November 19, 2025 - While you may argue that most modern ... Heap buffer overflow is a specific type of memory corruption vulnerability that targets dynamically allocated memory regions rather than the stack....
Stack based VS heap based buffer overflow - Stack Overflow
Why is heap-based buffer overflow difficult than stack-based? Also, what is the difference between them? I know that memory is allocated dynamically in case of heaps but, is that it? More on stackoverflow.com
Performance benefit of using buffer on heap over stack (C) - Stack Overflow
Is there any performance benefit to creating this buffer on the heap rather than the stack? It's existing code so it was done on the heap but I'm not sure if it would be faster to use the stack or what exactly the reasoning was to using the heap in the first place. Any ideas? This is C code. ... This is a great question. Like @SanderDeDycker points out local measurements based ... More on stackoverflow.com
ELI5 the difference between heaps, buffers, and stacks.
Heaps and stacks are two different data structures, that is, ways to store data that are studied in computer science, and used in many ways in writing software. Stacks are the simplest to understand. They store data in a line, and you can only add one new bit of data or access one single bit of data at a time. The only bit of data you can work with at a time is the last one you put in the stack. Think of it like every bit of data is a sheet of paper, and you lay them down in a stack on a table. At any given time you can only see the last one you put down. Stacks are used inside computers to keep track of which tasks they are doing in which order. Heaps are a little more complex. Each item in a heap has a parent item, except for one that is called the root. Either every item will be less than their parent item, or every item will be greater than their parent. Heaps are a more complex way for computers to keep track of what they are doing, and are used in different ways from stacks. Stacks are more basic, while heaps will be used to decide larger issues like which program is allowed to run when. A buffer isn't a data type at all, it's just a term for an area of computer memory which holds things temporarily until the computer has time to deal with it. So when you type on your keyboard, the key presses go to a keyboard buffer in case the computer is doing something else and not paying attention to the keyboard. A buffer overflow occurs when a buffer gets filled up before the computer can deal with it. A stack overflow occurs for a number of reasons, possibly that the software was not written well or has an error that causes it to repeat itself in a way that fills up a stack inside the computer. More on reddit.com
4
3
January 20, 2013Buffer overflows on the heap vs the stack - Information Security Stack Exchange
It is my current understanding ... a stack-based buffer overflow vulnerability, we must first overflow the buffer, thus overwriting the return pointer and gaining control of EIP. Once we control EIP, we can utilize a JMP ESP instruction in order to jump to the beginning of our stack, executing our shellcode (let's assume DEP or ASLR are not in place just for simplicity and theoretic sake). Now for the heap, I understand ... More on security.stackexchange.com
What programming languages are most vulnerable to heap buffer overflows?
C and C++ are the most vulnerable languages because they allow direct memory manipulation without built-in bounds checking. Languages like Rust, Go, and modern versions of Java and Python manage memory automatically, significantly reducing heap overflow risks. When these memory-safe languages call into C libraries, the vulnerability risk can still exist at the interface boundary.
automox.com
automox.com › blog › vulnerability-definition-heap-buffer
What is Heap Buffer Overflow Vulnerability?
How does ASLR protect against heap buffer overflow attacks?
Address Space Layout Randomization (ASLR) randomizes the memory addresses where the heap, stack, and libraries are loaded each time an application runs. This prevents attackers from reliably predicting where their exploit code or target data will be located in memory. Even if an attacker can trigger a heap overflow, ASLR makes it much harder to redirect execution to malicious code.
automox.com
automox.com › blog › vulnerability-definition-heap-buffer
What is Heap Buffer Overflow Vulnerability?
Can antivirus software detect heap buffer overflow exploits?
Traditional signature-based antivirus has limited effectiveness against heap buffer overflow exploits because each attack can be unique. Behavior-based endpoint protection and Endpoint Detection and Response (EDR) solutions can detect suspicious memory access patterns that indicate exploitation attempts. These tools work best when combined with regular patching to eliminate known vulnerabilities entirely.
automox.com
automox.com › blog › vulnerability-definition-heap-buffer
What is Heap Buffer Overflow Vulnerability?
Videos
07:07
Buffer Overflows Part 5 - Heap Overflow Basics - YouTube
33:43
How To Exploit a Heap Overflow - YouTube
02:34
CVE-2021-3156: Heap-Based Buffer Overflow in Sudo (Baron Samedit) ...
05:17
C Buffer Overflow, Heap/Stack Corruption and Analysis - YouTube
12:11
The Heap: How to exploit a Heap Overflow - bin 0x15 - YouTube
07:11
Heap Buffer Overflow - Exploiting the Heap - YouTube
Wikipedia
en.wikipedia.org › wiki › Heap_overflow
Heap overflow - Wikipedia
June 14, 2026 - A heap overflow, heap overrun, or heap smashing is a type of buffer overflow that occurs in the heap data area. Heap overflows are exploitable in a different manner to that of stack-based overflows. Memory on the heap is dynamically allocated at runtime and typically contains program data.
Medium
medium.com › @aviral23 › heap-based-buffer-overflow-attacks-the-stealthy-threat-to-your-systems-security-423e36429865
Heap-Based Buffer Overflow Attacks: The Stealthy Threat to Your System’s Security | by Aviral Srivastava | Medium
December 31, 2022 - There are several ways in which heap-based buffer overflows can be exploited. One common method is by tricking a program into allocating more memory to a buffer than is actually needed, and then injecting malicious code into the excess memory.
Medium
medium.com › @danielorihuelarodriguez › heap-based-buffer-overflows-5da499256a36
Heap-based buffer overflows. Table of Contents | by DanielOrihuela | Medium
November 5, 2024 - We can then rewrite the entry as newrootuser:AA3BKXQMdIWHE:0:0:root:/root:/tmp/etc/passwd. The last step is to make it longer to overflow the buffer. ./notetaker $(perl -e 'print "newrootuser:AA3BKXQMdIWHE:0:0:", "A" x 71, ":/root:/tmp/etc/passwd"') ... Exploiting heap and stack buffer overflows has the same difficulty.
Cloudmersive
cloudmersive.com › article › What-is-a-Heap-Based-Buffer-Overflow-Vulnerability
What is a Heap-Based Buffer Overflow Vulnerability? - Cloudmersive APIs
Review Cloudmersive's technical library · If a Heap-Based Buffer Overflow vulnerability is present in one of our image parsing or rendering technologies, threat actors can potentially exploit the vulnerability to run arbitrary code on our servers, and they can even crash our systems to cause ...
CVE Details
cvedetails.com › cwe-details › 122 › Heap-based-Buffer-Overflow.html
CWE 122 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
OWASP Foundation
owasp.org › www-project-web-security-testing-guide › v41 › 4-Web_Application_Security_Testing › 07-Input_Validation_Testing › 13.1-Testing_for_Heap_Overflow
Testing for heap overflow vulnerability
In this particular example, length is user-controllable and a malicious TNEF file can be crafted to set length to -1, which would result in malloc( 0 ). Therefore, this malloc would allocate a small heap buffer, which would be 16 bytes on most 32 bit platforms (as indicated in malloc.h). And now, in line 2, a heap overflow occurs in the call to fread( ).
CQR
cqr.company › web-vulnerabilities › heap
HEAP-Based Buffer Overflow vulnerability | CQR
A HEAP-Based buffer overflow vulnerability occurs when a program writes more data to a heap-allocated memory buffer than the buffer is designed to hold. This can cause the buffer to overflow, potentially overwriting adjacent memory and corrupting ...
Martellosecurity
martellosecurity.com › kb › mitre › cwe › 122
Heap-based Buffer Overflow | Martello Security
The buffer is allocated heap memory with a fixed size, but there is no guarantee the string in argv[1] will not exceed this size and cause an overflow. This example applies an encoding procedure to an input string and stores it into a buffer.
Fortinet
fortinet.com › resources › cyberglossary › buffer-overflow
What Is Buffer Overflow? Attacks, Types & Vulnerabilities | Fortinet
The stack-based approach occurs when an attacker sends data containing malicious code to an application, which stores the data in a stack buffer. This overwrites the data on the stack, including its return pointer, which hands control of transfers to the attacker. Heap-based buffer overflows: ...
Danielorihuela
danielorihuela.dev › blog › heap-based-buffer-overflows
Heap-based buffer overflows - Daniel Orihuela
November 19, 2023 - We can then rewrite the entry as newrootuser:AA3BKXQMdIWHE:0:0:root:/root:/tmp/etc/passwd. The last step is to make it longer to overflow the buffer. ./notetaker $(perl -e 'print "newrootuser:AA3BKXQMdIWHE:0:0:", "A" x 71, ":/root:/tmp/etc/passwd"') Exploiting heap and stack buffer overflows has the same difficulty.
Stack Overflow
stackoverflow.com › questions › 48728001 › stack-based-vs-heap-based-buffer-overflow
Stack based VS heap based buffer overflow - Stack Overflow
February 11, 2018 - Are you asking why it's harder to diagnose buffer overruns that occur on the heap than it is to diagnose buffer overruns that occur on the stack?
ResearchGate
researchgate.net › figure › Heap-based-buffer-overflow_fig2_225110279
Heap-based buffer overflow | Download Scientific Diagram
Download scientific diagram | Heap-based buffer overflow from publication: Efficient Protection Against Heap-Based Buffer Overflows Without Resorting to Magic | Bugs in dynamic memory management, including for instance heap-based buffer overflows and dangling pointers, are an important source of vulnerabilities in C and C++. Overwriting the management information of the memory allocation library is often a source of attack on these...
Top answer 1 of 2
3
If you are writing code for a very small system, you may need to get the buffer using malloc (or one of the related routines, such as calloc) so that you do not use limited stack space.
Otherwise, on modern systems, 1024 bytes is a modest amount of stack space to use, and creating a buffer on the stack is typically faster than using malloc. (A normal malloc call requires at least some amount of bookkeeping work that stack allocation does not. However, if a routine merely allocates a fixed-size buffer with malloc, uses it, and frees it, a compiler might optimize the buffer to a stack allocation anyway, in which case they would be equivalent.)
For reference, on macOS, Apple’s tools default to 8 MiB of space for the main stack and 2 MiB for each thread.
2 of 2
1
In general, stack allocation is always faster than heap allocation.
This is because stack allocation is as easy as a single write to the stack pointer, whereas dynamic memory allocation contains a lot of overhead code during allocation - malloc has to go look for the next free segment, possibly also handling issues with fragmentation etc.
If you re-use a buffer, you should make sure to only allocate it once, no matter where you allocate it. This might be in favour of the heap, since heap-allocated variables don't go out of scope.
As for accessing memory once it is allocated, the stack and heap should perform identically.
Most importantly, allocating a large chunk of data on the stack isn't recommended, since it has a limited size. 1024 bytes is fairly large, so the recommended practice would be to store it on the heap for that reason alone.
0x0ff
0x0ff.info › 2014 › heap-based-buffer-overflow
Heap-Based Buffer Overflow – 0x0ff.info
December 29, 2015 - Si vous n’avez pas eu le courage de vous investir dans ce billet, je vous propose un marche pied ludique qui vous demandera de compiler les sources de ce PoC cryptographique… Et pour vous encourager à franchir le pas, je dispose d’un argument de poids, Le programme est sensible au Heap-Based Buffer Overflow !
Reddit
reddit.com › r/explainlikeimfive › eli5 the difference between heaps, buffers, and stacks.
r/explainlikeimfive on Reddit: ELI5 the difference between heaps, buffers, and stacks.
January 20, 2013 -
I often see stack overflow and buffer overflow, or occasionally some reference to heaps and have no idea what any of it is.
Top answer 1 of 2
4
Heaps and stacks are two different data structures, that is, ways to store data that are studied in computer science, and used in many ways in writing software. Stacks are the simplest to understand. They store data in a line, and you can only add one new bit of data or access one single bit of data at a time. The only bit of data you can work with at a time is the last one you put in the stack. Think of it like every bit of data is a sheet of paper, and you lay them down in a stack on a table. At any given time you can only see the last one you put down. Stacks are used inside computers to keep track of which tasks they are doing in which order. Heaps are a little more complex. Each item in a heap has a parent item, except for one that is called the root. Either every item will be less than their parent item, or every item will be greater than their parent. Heaps are a more complex way for computers to keep track of what they are doing, and are used in different ways from stacks. Stacks are more basic, while heaps will be used to decide larger issues like which program is allowed to run when. A buffer isn't a data type at all, it's just a term for an area of computer memory which holds things temporarily until the computer has time to deal with it. So when you type on your keyboard, the key presses go to a keyboard buffer in case the computer is doing something else and not paying attention to the keyboard. A buffer overflow occurs when a buffer gets filled up before the computer can deal with it. A stack overflow occurs for a number of reasons, possibly that the software was not written well or has an error that causes it to repeat itself in a way that fills up a stack inside the computer.
2 of 2
2
The computer's memory is numbered in sequence. Each number (address) refers to a box of eight switches (bits) that are either on or off, the box is called a byte. They are always either on or off, whether a program has set them or not (they come randomized from the factory). If a program asks the operating system (which is just another program) to give it sets (blocks) of these boxes, defined by the starting address and number of bytes, then the set of boxes the OS uses to provide that is called the heap. Sometimes the program arranges these in a pile, so that the first block off the pile is the last block stacked on top, thus the term stack. There's a limit to how high the stack can get before it runs out of room (like the ceiling, but it's just the end of the big block designated to hold the stack). That's called overflow. Sometimes a program tries to take something off the stack when there's nothing there, and that's called underflow. When a bunch of blocks are used to set values being read from other blocks to work with later, that's a buffer. When a program runs out of room in a buffer, it's overflow, and when it tries to read from an empty buffer, that's underflow. In the exceptional case when unexpected overflow/underflow happens, the program needs to have a subprogram in place to handle that, called an exception handler. Bad programmers either don't write handlers for all exceptions, or don't write good ones. When a hacker can make a program do the wrong thing because an exception isn't handled properly, Bad Things can happen. Almost all hacking is made possible by bad programming. This is part of why hackers feel a sense of entitlement about what they do: they feel that bad programmers (and the people that buy those programs) deserve to get their programs hacked. This doesn't happen in isolation though: most of the rest of hacking is made possible by poor password choices.
MathWorks
mathworks.com › polyspace bug finder › reviewing and reporting results › polyspace bug finder results › coding standards › common weakness enumeration (cwe)
CWE Rule 122 - Heap-based Buffer Overflow - MATLAB
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Top answer 1 of 2
5
With a stack overflow - if you just keep overflowing - you overflow first locals vars, then saved registers, then the return address, then function arguments, then stuff further down the stack, maybe exception handlers, etc. Usually as an attacker you indeed use the overwritten return address to jump somewhere interesting.
With a heap overflow you overflow ... whatever lies beyond your piece of memory. In old or bad heap implementations that might be heap metadata that can give you e.g. the power to write stuff into targeted memory locations (which you could use to overwrite a function pointer). In other heap implementations you will have to engineer a pattern of allocations and deallocations to get the heap into a state where there is an interesting allocated piece to the right side of your piece of memory. Maybe a vtable or some other function pointers.
Heap overflows are highly specific to heap implementation and application. On linux there are the „house of ...“ techniques because glibc malloc is a joke (sorry!), on windows 7 the heap got very well secured and well randomized and you have to hope for applications to bring their own insecure heap implementations to get 1% more performance. They often do.
2 of 2
0
Gaining execution ability is indeed not the only way to exploit a buffer overflow. The heartbleed bug is a recent well known example of a heap buffer overflow type situation, where all the attacker could do was read beyond the buffer. Not write or gain execution ability. http://heartbleed.com
Elastic
elastic.co › elastic docs › reference › security › prebuilt detection rules reference › deprecated - sudo heap-based buffer overflow attempt
Deprecated - Sudo Heap-Based Buffer Overflow Attempt | Prebuilt detection rules reference
Identifies the attempted use of a heap-based buffer overflow vulnerability for the Sudo binary in Unix-like systems (CVE-2021-3156). Successful exploitation...