CWE-193

259 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 35High 95Medium 112Low 17Not scored 0

CVEs per yearBy the year they were published

CVE-2021-3156
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s"…
Product not named
ExploitedHigh7.8

CVE-2026-120061
psqlODBC ODBC escape parser stack buffer overflow
PostgreSQL · psqlODBC
High7.5
CVE-2026-116735
libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_6c_record_entries
libyal · libpff
Medium6.9
CVE-2026-115916
vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
vllm-project · vllm
Medium6.5
CVE-2026-114460
Mod_qos: query truncation during json body merging permits security-rule bypass
pbuchbinder · mod_qos
Medium5.3
CVE-2026-12727
IBM MQ Buffer Overflow
IBM · MQ Operator
Medium4.3
CVE-2026-111273
unarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name
selmf · unarr
Medium6.9
CVE-2026-108443
Microsoft Office Word Remote Code Execution Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise
High8.8
CVE-2026-101302
Remote DoS via receive-side kernel TLS
FreeBSD · FreeBSD
Medium6.5
CVE-2026-110604
Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod()
Michael R Sweet · Mini-XML
Low2.0
CVE-2026-97741
Microsoft Office Excel Remote Code Execution Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise
High8.8