Browse / Memory Corruption

Memory Corruption

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Memory Corruption - Generic395
• Use After Free90
• Buffer Over-read67
• Classic Buffer Overflow59
• Heap Overflow55
• Out-of-bounds Read49
• NULL Pointer Dereference42
• Stack Overflow35
• Integer Overflow28
• Double Free17
• Array Index Underflow16
• Improper Null Termination11
• Type Confusion9
• Incorrect Calculation of Buffer Size8
• Use of Externally-Controlled Format String8
• Buffer Underflow7
• Off-by-one Error6
• Integer Underflow5
• Buffer Under-read4
• Write-what-where Condition3
• Free of Memory not on the Heap1
• Integer Overflow to Buffer Overflow1
• Missing Release of Memory after Effective Lifetime1

Often found together with

• Code Execution156
• Denial of Service128
• Information Disclosure56

Most upvoted Memory Corruption reports

AllValidInformativeN/ADuplicate

1. RCE on Steam Client via buffer overflow in Server InfoClassic Buffer Overflow · critical · Valve
   1,289 votes
2. Use-After-Free In IPV6_2292PKTOPTIONS leading To Arbitrary Kernel R/W PrimitivesUse After Free · high · PlayStation
   $10,000741 votes
3. Malformed .BMP file in Counter-Strike 1.6 may cause shellcode injectionClassic Buffer Overflow · high · Valve
   321 votes
4. Heap overflow happen when receiving short length key from ssh server using ssh protocol 1Heap Overflow · high · PuTTY (European Commission - DIGIT)
   $3,646309 votes
5. SOCK_RAW sockets reachable from Webkit process allows triggering double free in IP6_EXTHDR_CHECKDouble Free · high · PlayStation
   $10,000298 votes
6. size_t-to-int vulnerability in exFAT leads to memory corruption via malformed USB flash drivesIncorrect Calculation of Buffer Size · high · PlayStation
   $10,000280 votes
7. Malformed NAV file leads to buffer overflow and code execution in Left4Dead2.exeClassic Buffer Overflow · critical · Valve
   $10,000268 votes
8. sys_fsc2h_ctrl kernel stack freeUse After Free · high · PlayStation
   $10,000236 votes
9. Unchecked weapon id in WeaponList message parser on client leads to RCEArray Index Underflow · critical · Valve
   $3,000229 votes
10. Double fdrop on a socket through sys_netcontrolDouble Free · high · PlayStation
    $10,000228 votes
11. HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organizationImproper Null Termination · high · HackerOne
    228 votes
12. OOB reads in network message handlers leads to RCEOut-of-bounds Read · critical · Valve
    $7,500219 votes
13. RCE on CS:GO client using unsanitized entity ID in EntityMsg messageOut-of-bounds Read · critical · Valve
    $9,000209 votes
14. Remote vulnerabilities in sppClassic Buffer Overflow · high · PlayStation
    $12,500197 votes
15. Buffer overrun in Steam SILK voice decoderClassic Buffer Overflow · critical · Valve
    $7,500196 votes
16. [Portal 2] Remote Code Execution via voice packetsClassic Buffer Overflow · critical · Valve
    $5,000173 votes
17. [Half-Life 1] Malformed map name leads to memory corruption and code executionClassic Buffer Overflow · high · Valve
    $1,500163 votes
18. Malformed .BSP Access Violation in CS:GO can lead to Remote Code ExecutionClassic Buffer Overflow · critical · Valve
    154 votes
19. Use-after-free in setsockopt IPV6_2292PKTOPTIONS (CVE-2020-7457)Use After Free · high · PlayStation
    $10,000143 votes
20. Subdomain Takeover Via Insecure CloudFront Distribution cdn.grab.comArray Index Underflow · medium · Grab
    $1,000142 votes
21. Race Conditions in Popular reports feature.Memory Corruption - Generic · HackerOne
    125 votes
22. Null Pointer Dereference by Crafted Response from AI ModelNULL Pointer Dereference · low · Brave Software
    116 votes
23. Specially Crafted Closed Captions File can lead to Remote Code Execution in CS:GO and other Source GamesClassic Buffer Overflow · critical · Valve
    $7,500109 votes
24. Access Violation Reading in libfaad_pluginInteger Underflow · medium · VLC (European Commission - DIGIT)
    $1,121106 votes
25. Null pointer dereference in SMTP server function smtp_string_parseNULL Pointer Dereference · Open-Xchange
    $1,500105 votes
26. Stack overflow in XML ParsingStack Overflow · high · Notepad++
    99 votes
27. Malformed .MDL triggers an Access Violation on GoldSRC (hl.exe)Memory Corruption - Generic · high · Valve
    90 votes
28. CVE-2022-40604: Apache Airflow: Format String VulnerabilityUse of Externally-Controlled Format String · critical · Internet Bug Bounty
    $8,00089 votes
29. Unauthenticated user can upload an attachment to the last updated report draftImproper Null Termination · high · HackerOne
    87 votes
30. Remote kernel heap overflowHeap Overflow · high · PlayStation
    86 votes
31. [steam client] Opening a specific steam:// url overwrites files at an arbitrary locationWrite-what-where Condition · medium · Valve
    $75080 votes
32. Access Violation Reading EXPLOITABLE_0228Double Free · medium · VLC (European Commission - DIGIT)
    $1,13577 votes
33. [FG-VD-19-009] Intel(R) Trace Analyzer and Collector 2019 Memory Corruption Vulnerability NotificationMemory Corruption - Generic · Intel Corporation
    $1,50077 votes
34. CVE-2021-22901: TLS session caching disasterUse After Free · high · curl
    76 votes
35. Heap Buffer Overflow (READ: 4) in phar_parse_pharfileBuffer Over-read · high · Internet Bug Bounty
    72 votes
36. Old WebKit HTML agent in Template Preview function has multiple known vulnerabilities leading to RCEUse After Free · Lob
    $1,50068 votes
37. CS:GO Server -> Client RCE through OOB access in CSVCMsg_SplitScreen + Info leak in HTTP downloadOut-of-bounds Read · critical · Valve
    $7,50066 votes
38. Improper input validation On Exported deep-link handler crashes `FileDisplayActivity` on crafted external URL — Denial-of-ServiceImproper Null Termination · Nextcloud
    65 votes
39. Image queue default key of 'None' and GraphQL unhandled type exceptionType Confusion · medium · Reddit
    $50065 votes
40. Type Confusion Vulnerability - SOAP / make_http_soap_request()Memory Corruption - Generic · Internet Bug Bounty
    $1,00064 votes
41. Malformed playlist.txt in GoldSrc games leads to Access Violation & arbitrary code executionStack Overflow · high · Valve
    $1,00062 votes
42. VLC 4.0.0 - Stack Buffer Overflow (SEH)Stack Overflow · high · VLC (European Commission - DIGIT)
    $2,81762 votes
43. Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.Memory Corruption - Generic · low · Node.js
    59 votes
44. Use-After-Free in SMB connection reuse (req->path dangling pointer after needle destruction)DuplicateUse After Free · high · curl
    58 votes
45. Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflowBuffer Over-read · high · Internet Bug Bounty
    $1,50058 votes
46. CVE-2023-38545: socks5 heap buffer overflowHeap Overflow · high · curl
    55 votes
47. Buffer overflow In hl.exe's launch -game argument allows an attacker to execute arbitrary code locally or from browserStack Overflow · high · Valve
    55 votes
48. Buffer overflow in strcpyN/ABuffer Underflow · critical · curl
    53 votes
49. CVE-2024-7264: ASN.1 date parser overreadBuffer Over-read · low · curl
    53 votes
50. Integer overflow leading to buffer overflowInteger Overflow · critical · Internet Bug Bounty
    $1,00052 votes
51. Stack Buffer Overflow in mariadb-dump quote_name() Allows Malicious Server to Execute Arbitrary Code on ClientStack Overflow · critical · MariaDB
    51 votes
52. Buffer overflow in PyCArg_repr in _ctypes/callproc.c for Python 3.x to 3.9.1Classic Buffer Overflow · high · Internet Bug Bounty
    $1,50051 votes
53. Stack overflow affecting "ext" field on stylers.xml configuration fileStack Overflow · medium · Notepad++
    51 votes
54. Heap overflow in mysqlnd related to BIT fields (CVE-2016-7412)Memory Corruption - Generic · medium · Internet Bug Bounty
    50 votes
55. [CS:GO] Unchecked texture file name with TEXTUREFLAGS_DEPTHRENDERTARGET can lead to Remote Code ExecutionStack Overflow · high · Valve
    $2,50048 votes
56. Integer Underflow in src/var.cN/AInteger Underflow · medium · curl
    46 votes
57. Memory corruption in imap-parser.cMemory Corruption - Generic · Open-Xchange
    $5,00046 votes
58. puttygen: 160MB memory leak while trying to extract openssh public key from crafted key fileMemory Corruption - Generic · low · PuTTY (European Commission - DIGIT)
    46 votes
59. Buffer Overflow Vulnerability in strcpy() Leading to Remote Code ExecutionN/AClassic Buffer Overflow · critical · curl
    45 votes
60. NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changesetInformativeNULL Pointer Dereference · high · Node.js
    44 votes
61. wallet-rpc crash via malformed /gettransactions response (empty txs → vector::front() in check_tx_key / check_tx_proof)NULL Pointer Dereference · high · Monero
    44 votes
62. Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijackingOut-of-bounds Read · high · MariaDB
    43 votes
63. CVE-2024-7347: Buffer overread in the ngx_http_mp4_moduleBuffer Over-read · medium · Internet Bug Bounty
    $2,14243 votes
64. Integer overflow in CipherUpdateInteger Overflow · high · Internet Bug Bounty
    43 votes
65. [3DS][SSL][SDK] Unchecked number of audio channels in Mobiclip SDK leads to RCE in eShop movie playerHeap Overflow · Nintendo
    43 votes
66. mbedTLS private-key blob null-termination asymmetry in lib/vtls/mbedtls.c (mbed_load_privkey)InformativeImproper Null Termination · curl
    42 votes
67. [Wii U/3DS/Switch] Improper bounds check in StationURL in all NEX clients leading to remote crash/RCEDuplicateStack Overflow · low · Nintendo
    42 votes
68. CVE-2019-11043: a buffer underflow in fpm_main.c can lead to RCE in php-fpmBuffer Underflow · critical · Internet Bug Bounty
    $1,50042 votes
69. Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.cInteger Overflow · medium · Internet Bug Bounty
    42 votes
70. apache access.log leakage via long request on https://rapida.ru/Buffer Over-read · QIWI
    42 votes
71. V1Plugin.Decrypt panics on empty ciphertext (Remote DoS)Array Index Underflow · medium · AWS VDP
    41 votes
72. mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full (CVE-2020-7065)Stack Overflow · high · Internet Bug Bounty
    40 votes
73. Buffer Overflow Risk in Curl_inet_ntop and inet_ntop4N/AClassic Buffer Overflow · high · curl
    39 votes
74. Big XSS vulnerability!SpamClassic Buffer Overflow · medium · Legal Robot
    39 votes
75. urlapi: off-by-one in custom scheme validation skips last characterInformativeOff-by-one Error · high · curl
    38 votes
76. Buffer Overflow Vulnerability in WebSocket HandlingN/AHeap Overflow · high · curl
    38 votes
77. UAF on JSEthereumProviderUse After Free · critical · Brave Software
    38 votes
78. [3DS][SSL] Use of uninitialized class member leads to RCE in eShop movie playerUse After Free · Nintendo
    38 votes
79. Crash in mrb_ary_pushNULL Pointer Dereference · shopify-scripts
    $80037 votes
80. Integer Overflow in curl_multi_get_handles() Leading to Heap Buffer OverflowN/AClassic Buffer Overflow · medium · curl
    36 votes
81. CVE-2025-9086: Out of bounds read for cookie pathBuffer Over-read · low · curl
    36 votes
82. [Switch, PIA/MK8DX] Stack buffer overflow and potential RCE in PIA (LAN/LDN, possibly NEX) room info deserializationStack Overflow · medium · Nintendo
    36 votes
83. [MK8DX] Improper ranking/replay file parsingMemory Corruption - Generic · critical · Nintendo
    36 votes
84. Buffer overflow in req_parsebody method in lua_request.cHeap Overflow · high · Internet Bug Bounty
    36 votes
85. [Switch] Remote stack buffer overflow in the LDN/LP2P DHCP server leads to control-flow hijackStack Overflow · high · Nintendo
    35 votes
86. Signedness issue in ClassInfo message handler leads to RCE on CS:GO clientArray Index Underflow · critical · Valve
    $7,50035 votes
87. PHP mbstring / Oniguruma multiple remote heap/stack corruptionsHeap Overflow · critical · Internet Bug Bounty
    $1,50035 votes
88. Double free vulnerability in Flash Player Settings Manager (CVE-2015-0346)Memory Corruption - Generic · Internet Bug Bounty
    $5,00035 votes
89. CVE-2026-3805: use after free in SMB connection reuseUse After Free · medium · curl
    34 votes
90. Heap-Buffer-Overread in contains_whitespace when calling parser_validate after supplying a maliciously crafted buffer to parser_parseBuffer Over-read · Cosmos
    $2,00034 votes
91. CVE-2024-6197: freeing stack buffer in utf8asn1strFree of Memory not on the Heap · medium · curl
    34 votes
92. 1-byte heap buffer overflow in DNS resolverOff-by-one Error · medium · Internet Bug Bounty
    34 votes
93. Firecracker Out-of-bounds Read/Write Local Privilege Escalation VulnerabilityOut-of-bounds Read · AWS VDP
    33 votes
94. Conflux-queued zero-length RELAY_END triggers heap out-of-bounds readOut-of-bounds Read · medium · Tor
    33 votes
95. Buffer overflow in yywarning_sClassic Buffer Overflow · shopify-scripts
    $1,00033 votes
96. Buffer overflows in demo parsingClassic Buffer Overflow · medium · Valve
    33 votes
97. CVE-2024-31079 in nginxStack Overflow · medium · Internet Bug Bounty
    $2,60032 votes
98. Cache poisoning using NULL bytes and long URLsImproper Null Termination · medium · Greenhouse.io
    32 votes
99. JSBeautifier BApp: Race condition leads to memory disclosureMemory Corruption - Generic · high · PortSwigger Web Security
    32 votes
100. Connector/C Out-of-bounds read in `unpack_fields()` from short metadata fieldOut-of-bounds Read · MariaDB
     31 votes