CWE-120: Classic Buffer Overflow — known CVE vulnerabilities

CVEs classified under CWE-120 (Classic Buffer Overflow), ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (50)

• CVE-2025-48611 — CVSS 10.0 (critical): In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation…
• CVE-2026-24823: Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in FASTSHIFT X-TRACK…
• CVE-2026-24810: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in rethinkdb (src/cjson modules). This vulnerability…
• CVE-2026-24800: Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow furnace…
• CVE-2025-9962: A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior authentication.This issue…
• CVE-2010-10016: BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality. When processing .m3u files, the…
• CVE-2012-10035: Turbo FTP Server versions 1.30.823 and 1.30.826 contain a buffer overflow vulnerability in the handling of the PORT command. By sending a…
• CVE-2024-36290 — CVSS 10.0 (critical): A buffer overflow vulnerability exists in the login.cgi Goto_chidx() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially…
• CVE-2024-25139 — CVSS 10.0 (critical): In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based…
• CVE-2024-22039 — CVSS 10.0 (critical): A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Panel FC72x IP6 (All…
• CVE-2024-23621 — CVSS 10.0 (critical): A buffer overflow exists in IBM Merge Healthcare eFilm Workstation license server. A remote, unauthenticated attacker can exploit this…
• CVE-2024-23616 — CVSS 10.0 (critical): A buffer overflow vulnerability exists in Symantec Server Management Suite version 7.9 and before. A remote, anonymous attacker can exploit…
• CVE-2024-23615 — CVSS 10.0 (critical): A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 10.5 and before. A remote, anonymous attacker can exploit…
• CVE-2024-23614 — CVSS 10.0 (critical): A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 9.5 and before. A remote, anonymous attacker can exploit this…
• CVE-2024-23613 — CVSS 10.0 (critical): A buffer overflow vulnerability exists in Symantec Deployment Solution version 7.9 when parsing UpdateComputer tokens. A remote, anonymous…
• CVE-2023-1424 — CVSS 10.0 (critical): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series…
• CVE-2021-33975 — CVSS 10.0 (critical): Buffer Overflow vulnerability in Qihoo 360 Total Security v10.8.0.1060 and v10.8.0.1213 allows attacker to escalate privileges.
• CVE-2021-33972 — CVSS 10.0 (critical): Buffer Overflow vulnerability in Qihoo 360 Safe Browser v13.0.2170.0 allows attacker to escalate priveleges.
• CVE-2023-24482 — CVSS 10.0 (critical): A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3.1 (All versions < V10.3.3.1.45), COMOS V10.3.3.2 (All…
• CVE-2022-32548 — CVSS 10.0 (critical): An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a…
• CVE-2022-22683 — CVSS 10.0 (critical): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before…
• CVE-2022-31481 — CVSS 10.0 (critical): An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts…
• CVE-2022-22570 — CVSS 10.0 (critical): A buffer overflow vulnerability found in the UniFi Door Access Reader Lite’s (UA Lite) firmware (Version 3.8.28.24 and earlier) allows a…
• CVE-2015-5093 — CVSS 10.0 (critical): Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before…
• CVE-2011-4862 — CVSS 10.0 (critical): Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and…
• CVE-2008-3496 — CVSS 10.0 (critical): Buffer overflow in format descriptor parsing in the uvc_parse_format function in drivers/media/video/uvc/uvc_driver.c in uvcvideo in the…
• CVE-2007-1770 — CVSS 10.0 (critical): Buffer overflow in the ArcSDE service (giomgr) in Environmental Systems Research Institute (ESRI) ArcGIS before 9.2 Service Pack 2, when…
• CVE-2002-1337 — CVSS 10.0 (critical): Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related…
• CVE-2001-0554 — CVSS 10.0 (critical): Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a…
• CVE-2001-0191 — CVSS 10.0 (critical): gnuserv before 3.12, as shipped with XEmacs, does not properly check the specified length of an X Windows MIT-MAGIC-COOKIE cookie, which…
• CVE-1999-1237 — CVSS 10.0 (critical): Multiple buffer overflows in smbvalid/smbval SMB authentication library, as used in Apache::AuthenSmb and possibly other modules, allows…
• CVE-1999-0385 — CVSS 10.0 (critical): The LDAP bind function in Exchange 5.5 has a buffer overflow that allows a remote attacker to conduct a denial of service or execute…
• CVE-1999-0046 — CVSS 10.0 (critical): Buffer overflow of rlogin program using TERM environmental variable.
• CVE-2025-20333 — CVSS 9.9 (critical) — actively exploited: A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat…
• CVE-2023-36355 — CVSS 9.9 (critical): TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at /userRpm/WanDynamicIpV6CfgRpm. This…
• CVE-2021-29068 — CVSS 9.9 (critical): Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R6700v3 before 1.0.4.98, R6400v2 before…
• CVE-2020-27486 — CVSS 9.9 (critical): Garmin Forerunner 235 before 8.20 is affected by: Buffer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the…
• CVE-2017-16347 — CVSS 9.9 (critical): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At…
• CVE-2017-16346 — CVSS 9.9 (critical): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At…
• CVE-2017-16345 — CVSS 9.9 (critical): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At…
• CVE-2017-16344 — CVSS 9.9 (critical): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At…
• CVE-2017-16343 — CVSS 9.9 (critical): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At…
• CVE-2017-16342 — CVSS 9.9 (critical): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At…
• CVE-2017-16341 — CVSS 9.9 (critical): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At…
• CVE-2017-16340 — CVSS 9.9 (critical): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At…
• CVE-2017-16339 — CVSS 9.9 (critical): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At…
• CVE-2017-16338 — CVSS 9.9 (critical): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At…
• CVE-2017-14445 — CVSS 9.9 (critical): An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation…
• CVE-2026-30141 — CVSS 9.8 (critical): An issue was discovered in bitbank2 AnimatedGIF v2.2.0. A buffer overflow in the DecodeLZW function allows remote attackers to cause a…
• CVE-2019-25741 — CVSS 9.8 (critical): Mobatek MobaXterm 12.1 contains a structured exception handling (SEH) based buffer overflow vulnerability in the username field of session…