Browse / Memory Corruption

Memory Corruption

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Memory Corruption - Generic395
• Use After Free90
• Buffer Over-read67
• Classic Buffer Overflow59
• Heap Overflow55
• Out-of-bounds Read49
• NULL Pointer Dereference42
• Stack Overflow35
• Integer Overflow28
• Double Free17
• Array Index Underflow16
• Improper Null Termination11
• Type Confusion9
• Incorrect Calculation of Buffer Size8
• Use of Externally-Controlled Format String8
• Buffer Underflow7
• Off-by-one Error6
• Integer Underflow5
• Buffer Under-read4
• Write-what-where Condition3
• Free of Memory not on the Heap1
• Integer Overflow to Buffer Overflow1
• Missing Release of Memory after Effective Lifetime1

Often found together with

• Code Execution156
• Denial of Service128
• Information Disclosure56

Most upvoted Memory Corruption reports

AllValidInformativeN/ADuplicate

1. NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changesetInformativeNULL Pointer Dereference · high · Node.js
   44 votes
2. mbedTLS private-key blob null-termination asymmetry in lib/vtls/mbedtls.c (mbed_load_privkey)InformativeImproper Null Termination · curl
   42 votes
3. urlapi: off-by-one in custom scheme validation skips last characterInformativeOff-by-one Error · high · curl
   38 votes
4. Use After Free (that leads to arbitrary Write for some versions) InformativeUse After Free · curl
   30 votes
5. Heap‑based buffer overflow in curl -K <config_file> allows arbitrary write .InformativeHeap Overflow · high · curl
   29 votes
6. Memory LeakInformativeMemory Corruption - Generic · curl
   28 votes
7. Heap-OOB read in urlapi `redirect_url()` via `CURLU_GUESS_SCHEME` + `CURLU_NO_GUESS_SCHEME` flowInformativeBuffer Over-read · curl
   27 votes
8. Use after free (read) in curl_multi_perform with DoH and Proxy options, and resolve timeoutsInformativeUse After Free · curl
   26 votes
9. NULL dereference when encoding DN of x509 certificateInformativeNULL Pointer Dereference · low · curl
   26 votes
10. NULL Pointer Dereference (DoS) in libcurl SFTP QUOTE command parsing due to missing return statementInformativeNULL Pointer Dereference · medium · curl
    25 votes
11. Heap-buffer-overflow (Out-of-Bounds Read) in DoH hostname encodingInformativeOut-of-bounds Read · curl
    24 votes
12. 55: Heap-buffer-overflow read in `curl_formadd_ccsid()` with binary form dataInformativeOut-of-bounds Read · curl
    23 votes
13. heap-use-after-free in state.referer when CURLOPT_REFERER replaced or cleared after performInformativeUse After Free · low · curl
    22 votes
14. OpenSSL HTTP/3 bogus CURLINFO_TLS_SSL_PTRInformativeUse After Free · curl
    21 votes
15. UAF read in mev_pollset_diff() trace path after curl_easy_pause() in socket callbackInformativeUse After Free · low · curl
    19 votes
16. Use after free in hyperfifo exampleInformativeUse After Free · curl
    19 votes
17. Use-after-free of the internal multi->admin easy handle via the documented CURLMOPT_NOTIFYFUNCTION callbackInformativeUse After Free · medium · curl
    17 votes
18. int overflow in krb5_read_data() leads to (possible) massive `recv()` writeInformativeInteger Overflow · low · curl
    17 votes
19. Telnet Suboption Buffer Pointer Underflow in lib/telnet.c leads to Out-of-Bounds ReadInformativeBuffer Under-read · low · curl
    16 votes
20. Use-after-free when POST body buffer is freed before transferInformativeUse After Free · medium · curl
    16 votes
21. Use after free (or assert triggered) with failed allocations in opensslInformativeUse After Free · curl
    15 votes
22. MQTT Protocol Violation & Integer Overflow in libcurlInformativeInteger Overflow · high · curl
    14 votes
23. Zip bombInformativeIncorrect Calculation of Buffer Size · critical · Tor
    14 votes
24. Use-after-free in `mev_forget_socket` when `curl_easy_pause()` is called from a `CURL_POLL_REMOVE` socket callback (incomplete fix of CVE-2026-9080)InformativeUse After Free · low · curl
    13 votes
25. CURLOPT_HSTS_CTRL disables shared HSTS without share guard — use-after-free and double-freeInformativeUse After Free · curl
    12 votes
26. 54: Rejected HTTP/2 push destroys MIME callback state still used by parent (use-after-free)InformativeUse After Free · curl
    11 votes
27. Use of unitialized value in crypto_pk_num_bits (src/common/crypto.c:971)InformativeMemory Corruption - Generic · Tor
    11 votes
28. Use-after-free during XML transformations (MFSA-2016-27)InformativeMemory Corruption - Generic · Tor
    $30010 votes
29. Heap-use-after-free in libcurl's multi event machinery (curl_multi_remove_handle() from a socket callback nested under a notify callback)InformativeUse After Free · low · curl
    9 votes
30. solving TOR vulnerability, in other to make bruteforce difficultInformativeArray Index Underflow · low · Tor
    9 votes
31. WebSocket decoder use-after-free when curl_easy_pause() unpauses from a debug callbackInformativeUse After Free · curl
    8 votes
32. Use-After-Free in curl_easy_nextheader when reusing header handle across requestsInformativeUse After Free · curl
    8 votes
33. Stack Buffer Overflow in mprintf.c formatting function (fallback path)InformativeClassic Buffer Overflow · high · curl
    8 votes
34. libcurl MQTT `CURLOPT_POSTFIELDSIZE_LARGE` overflow leads to immediate DoSInformativeInteger Overflow · medium · curl
    8 votes
35. Double free caused by mqtt_doing()InformativeDouble Free · curl
    8 votes
36. Buffer Overflow in curl's Rustls BackendInformativeInteger Overflow · curl
    8 votes
37. Free of uninitialized pointer in doh_decode_rdata_name()InformativeUse After Free · curl
    8 votes
38. Out-of-bounds read in curl_formadd when CURLFORM_NAMELENGTH is explicitly 0InformativeMemory Corruption - Generic · curl
    7 votes
39. Heap-use-after-free in CURLOPT_REFERER when passed a CURLINFO_REFERER pointerInformativeMemory Corruption - Generic · low · curl
    7 votes
40. Integer-underflow leads to heap over-read in TFTP implementationInformativeBuffer Over-read · low · curl
    7 votes
41. 57: Heap out-of-bounds read in `curl_easy_escape_ccsid()` / `curl_easy_unescape_ccsid()`InformativeOut-of-bounds Read · curl
    5 votes
42. Use-after-free in `curl_easy_duphandle()` with HTTP/2 stream-dependency treeInformativeUse After Free · curl
    5 votes
43. NULL pointer dereference in libcurl URL API redirect_url() with CURLU_DEFAULT_SCHEMEInformativeNULL Pointer Dereference · curl
    5 votes
44. integer Overflow in MQTT Protocol Handling Allows Bypassing Message Size LimitInformativeInteger Overflow · high · curl
    5 votes
45. Double free in tool_ssls_load()InformativeDouble Free · curl
    5 votes
46. Invalid write (or double free) triggers curl command line tool crashInformativeDouble Free · high · curl
    4 votes
47. Integer overflows in tool_operate.c at line 1541InformativeInteger Overflow · low · curl
    4 votes
48. Signed integer overflow in tool_progress_cb()InformativeInteger Overflow · curl
    4 votes
49. Ruby 2.4.1 has "Stack consistency error" and aborts when processing return statement within a case statementInformativeMemory Corruption - Generic · Ruby
    4 votes
50. libcurl TLS shorter-retry mismatch discloses client heap memory during cancelled IMAPS uploadInformativeOut-of-bounds Read · medium · curl
    3 votes
51. CURLSHOPT_UNSHARE race can cause UAF in shared SSL session cache during HTTPS transferInformativeUse After Free · curl
    3 votes
52. Android App Crashes while sending message to users/ on channel InformativeClassic Buffer Overflow · high · Rocket.Chat
    3 votes
53. Integer overflow in the source code tool_cb_prg.cInformativeInteger Overflow · curl
    3 votes
54. Stack Trace on jenkins.brew.shInformativeStack Overflow · medium · Homebrew
    3 votes
55. Email spoofing in [email protected]InformativeMemory Corruption - Generic · Paragon Initiative Enterprises
    3 votes
56. WebSocket send queue use-after-free during nested curl_ws_send()InformativeUse After Free · low · curl
    2 votes
57. Heap Buffer Overflow (READ of size 1) in ourWriteOutInformativeHeap Overflow · low · curl
    2 votes
58. Integer overlow in "header_append" functionInformativeInteger Overflow · curl
    2 votes
59. Use After Free in crypto.randomFillInformativeUse After Free · Node.js
    2 votes
60. Use of uninitialized value in networkstatus_parse_vote_from_string (src/or/routerparse.c:3533)InformativeMemory Corruption - Generic · Tor
    2 votes
61. Interger overflow in eval trigger write out of boundInformativeInteger Underflow · medium · Internet Bug Bounty
    2 votes
62. Null Byte Injection in all fields of ProfileInformativeImproper Null Termination · Legal Robot
    2 votes
63. heap-buffer-overflow (read outside of buffer) in Sass::Prelexer::exactly<(char)92>(char const*) - libsass/src/lexer.hpp:92InformativeHeap Overflow · high · LibSass
    2 votes
64. Session Management Issue CMS AirshipInformativeMemory Corruption - Generic · Paragon Initiative Enterprises
    2 votes
65. Heap corruption in string.c tr_trans() due to undersized bufferInformativeMemory Corruption - Generic · Ruby
    2 votes
66. Occasional use-after-free in multi_done() libcurl-7.81.0InformativeUse After Free · low · curl
    1 votes
67. Race condition with CURL_LOCK_DATA_CONNECT can cause connections to be used at the same timeInformativeUse After Free · low · curl
    1 votes
68. use after free in cookie.cInformativeUse After Free · low · curl
    1 votes
69. Potential invocation of qsort on uninitialized memory during cookie saveInformativeMemory Corruption - Generic · low · curl
    1 votes
70. Buffer write overflow when forming dns over http requestInformativeClassic Buffer Overflow · low · curl
    1 votes
71. Integer overflow at line 1603 in the src/operator.c fileInformativeInteger Overflow · low · curl
    1 votes
72. huge COLUMNS causes progress-bar to buffer overflowInformativeClassic Buffer Overflow · low · curl
    1 votes
73. libcurl: SMTP end-of-response out-of-bounds read - CVE-2019-3823InformativeHeap Overflow · high · curl
    1 votes
74. User provided values passed to PHP unset() functionInformativeType Confusion · Coinbase
    1 votes
75. Use of uninitialized value in memarea_strdup (src/common/memarea.c:369)InformativeMemory Corruption - Generic · Tor
    1 votes
76. Stack overflow in UnbindFromTree (browser can be crashed remotely)InformativeStack Overflow · high · Tor
    1 votes
77. Heap corruption in DateTime.strftime() on 32 bit for certain format stringsInformativeMemory Corruption - Generic · Ruby
    1 votes
78. Curl_auth_create_plain_message integer overflow leads to heap buffer overflowInformativeIncorrect Calculation of Buffer Size · low · curl
79. Double-free of `trailers_buf' on `Curl_http_compile_trailers()` failureInformativeDouble Free · medium · curl
80. Integer Underflow @ ossl_cipher_pkcs5_keyivgen InformativeInteger Underflow · Ruby
81. Crashes/Buffer at 0x2C0086,name=PBrowser::Msg_Destroy InformativeClassic Buffer Overflow · medium · Tor
82. MISSING SPF RECORDS & MISSING DKIM POLICYInformativeMemory Corruption - Generic · LeaseWeb
83. nginx SPDY heap buffer overflow for https://grtp.co/InformativeMemory Corruption - Generic · Gratipay