CWE-122 is MITRE’s weakness category for heap-based buffer overflows. It describes bugs where a program writes past the end of dynamically allocated memory on the heap. Unlike a stack overflow, this affects memory managed at runtime, which can corrupt nearby objects, crash a process, or alter program behavior in unpredictable ways.
In cyber security, CWE-122 matters because heap corruption can sometimes be turned into code execution or privilege escalation, especially in trusted components that process attacker-controlled input. Defenders look for it in parsers, file handlers, drivers, and system security features. Common mitigations include bounds checking, safe memory handling, fuzz testing, compiler hardening, address sanitizers, and memory-safe languages where practical. When a flaw is classified as CWE-122, it signals a serious memory-safety problem that can threaten both availability and integrity.