Memory corruption vulnerabilities
The program reads or writes memory it should not, usually through a buffer overflow. The result ranges from a crash to full code execution.
Memory corruption in numbers
sbomify tracks 53,628 memory corruption vulnerabilities. Most are found in desktop application (22%), library (22%) and operating system (18%).
How to fix memory corruption vulnerabilities
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases.
Most exploited memory corruption vulnerabilities
- CVE-2025-43300 Apple iOS, iPadOS, and macOS Out-of-Bounds Write
- CVE-2025-24201 Apple Multiple Products WebKit Out-of-Bounds Write
- CVE-2022-20700 Cisco Small Business RV Series Routers Stack-based Buffer Overflow
- CVE-2022-20701 Cisco Small Business RV Series Routers Stack-based Buffer Overflow
- CVE-2020-14871 Oracle Solaris and Zettabyte File System (ZFS) Unspecified
- CVE-2020-1350 Microsoft Windows DNS Server Remote Code Execution
- CVE-2020-0796 Microsoft SMBv3 Remote Code Execution
- CVE-2025-42599 Qualitia Active! Mail Stack-Based Buffer Overflow
- CVE-2025-31200 Apple Multiple Products Memory Corruption
- CVE-2024-38812 VMware vCenter Server Heap-Based Buffer Overflow
- CVE-2024-37079 Broadcom VMware vCenter Server Out-of-bounds Write
- CVE-2023-34048 VMware vCenter Server Out-of-Bounds Write
Recently published
- CVE-2025-60480 Memory corruption in n/a
- CVE-2026-10572 IBM MQ Buffer Overflow
- CVE-2026-10574 IBM MQ Buffer Overflow
- CVE-2026-105810 Authenticated Local Stack Overflow in TP-Link Tapo C320WS
- CVE-2026-108984 GV-ASManager Web Server Buffer Overflow Vulnerability
- CVE-2026-110672 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.
Other types of vulnerability
- Cross-site scripting54,178
- Denial of service36,532
- 35,428
- Missing authorization28,513
- SQL injection23,565
- Path traversal19,236
- 16,160
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.