Weakness (CWE)
CWE-121: Stack-based Buffer Overflow
The product writes past the end of a buffer that was allocated on the stack.
How to prevent it (5 mitigations)
-
Operation, Build and Compilation
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
-
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
-
Implementation
Implement and perform bounds checking on input.
-
Implementation
Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
-
Operation, Build and Compilation
Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Source: MITRE CWE-121
93 results · Clear filters · Feed
-
High 7.5CVE-2026-116567 Public exploit
FreeSWITCH: Pre-authentication stack buffer overflow in mod_rtmp control-message handling
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_handle_control() rendered an RTMP user-control message…
-
High 7.8CVE-2026-92183 Public exploit
GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that …
-
High 8.5CVE-2026-105810 Public exploit
Authenticated Local Stack Overflow in TP-Link Tapo C320WS
Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated attacker on the adjacent network can submit a crafted request containing an oversized encrypted password field, overwrite…
-
High 7.5CVE-2026-63292 Public exploit
Apache HTTP Server: mod_vhost_alias stack overflow
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header ex…
-
High 8.8CVE-2026-89020 Public exploit
MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path Leading to Privilege Escalation
MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 5…
-
High 8.8CVE-2026-56766 Public exploit
Hydra - Stack Buffer Overflow in NTLM Authentication Handler
Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a…
-
High 8.8CVE-2026-11553 Public exploit
Tenda HG7/HG9/HG10 formPPPEdit stack-based overflow
A vulnerability was found in Tenda HG7, HG9 and HG10 300001138_en_xpon. This affects the function formPPPEdit of the file /boaform/formPPPEdit. The manipulation of the argument encodename results in stack-based buffer overflow. The attack can be launched remo…
-
High 7.3CVE-2026-38422 Public exploit
Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary co…
-
High 7.8CVE-2026-45250 Public exploit
Stack buffer overflow via setcred(2)
The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer without first validating its length.…
-
High 7.5CVE-2026-39047 Public exploit
Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute arbitrary code via the RAW Pri…
-
High 8.6CVE-2026-6643 Public exploit
A stack-based buffer overflow vulnerability in the VPN Clients on the ADM
A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-controlled data directly to printf(). Due to the lack of PIE and Stack Canary protections, an authenticate…
-
High 8.6CVE-2026-40489 Public exploit
editorconfig-core-c has incomplete fix for CVE-2023-0341
editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig…
-
High 8.8CVE-2026-4961 Public exploit
Tenda AC6 POST Request QuickIndex formQuickIndex stack-based overflow
A vulnerability was identified in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. The manipulation of the argument PPPOEPassword leads to stack-based bu…
-
High 8.8CVE-2026-4861 Public exploit
Wavlink WL-NU516U1 nas.cgi ftext stack-based overflow
A weakness has been identified in Wavlink WL-NU516U1 260227. This vulnerability affects the function ftext of the file /cgi-bin/nas.cgi. This manipulation of the argument Content-Length causes stack-based buffer overflow. The attack can be initiated remotely.…
-
High 8.8CVE-2026-4747 Public exploit
Remote code execution via RPCSEC_GSS packet validation
Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a stack buffer, but fails to ensure that the buffer is sufficiently large, and a malicious client can trigger a stac…
-
High 7.3CVE-2026-33147 Public exploit
GMT: Stack-based Buffer Overflow in gmt_remote_dataset_id
GMT is an open source collection of command-line tools for manipulating geographic and Cartesian data sets. In versions from 6.6.0 and prior, a stack-based buffer overflow vulnerability was identified in the gmt_remote_dataset_id function within src/gmt_remot…
-
High 8.8CVE-2026-4444 Public exploit
Stack buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially explo…
-
High 7.3CVE-2025-69720 Public exploit
The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in pro…
-
High 8.5CVE-2026-1457 Public exploit
Authenticated RCE Vulnerability Due to Buffer Overflow on TP-Link VIGI C385
An authenticated buffer handling flaw in TP-Link VIGI C385 V1 Web API lacking input sanitization, may allow memory corruption leading to remote code execution. Authenticated attackers may trigger buffer overflow and potentially execute arbitrary code with ele…
-
High 8.4CVE-2021-47881 Public exploit
dataSIMS Avionics ARINC 664-1 - Local Buffer Overflow
dataSIMS Avionics ARINC 664-1 version 4.5.3 contains a local buffer overflow vulnerability that allows attackers to overwrite memory by manipulating the milstd1553result.txt file. Attackers can craft a malicious file with carefully constructed payload and ali…
-
High 8.8CVE-2025-66177 Public exploit
There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models…
-
High 8.8CVE-2025-60690 Public exploit
A stack-based buffer overflow exists in the get_merge_ipaddr function of the httpd binary on Linksys E1200 v2 routers (…
-
High 7.7CVE-2025-62507 Public exploit
Redis: Bug in XACKDEL may lead to stack overflow and potential RCE
Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed…
-
High 7.5CVE-2025-60751 Public exploit
GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode.
-
High 7.7
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Softw…
KEV Sep 29, 2025 -
High 8.6CVE-2009-20008 Public exploit
Green Dam 3.17 URL Processing Buffer Overflow
Green Dam Youth Escort version 3.17 is vulnerable to a stack-based buffer overflow when processing overly long URLs. The flaw resides in the URL filtering component, which fails to properly validate input length before copying user-supplied data into a fixed-…
-
High 7.5CVE-2008-20001 Public exploit
activePDF WebGrabber ActiveX Control Buffer Overflow
activePDF WebGrabber version 3.8.2.0 contains a stack-based buffer overflow vulnerability in the GetStatus() method of the APWebGrb.ocx ActiveX control. By passing an overly long string to this method, a remote attacker can execute arbitrary code in the conte…
-
High 7.5CVE-2025-55763 Public exploit
Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote cod…
-
High 8.4CVE-2009-20003 Public exploit
Xenorate <= 2.50 .xpl File Stack-Based Buffer Overflow
Xenorate versions up to and including 2.50, a Windows-based multimedia player, is vulnerable to a stack-based buffer overflow when processing .xpl playlist files. The application fails to properly validate the length of input data, allowing an attacker to cra…
-
High 8.4CVE-2010-20114 Public exploit
VariCAD EN <= 2010-2.05 .dwb File Stack Buffer Overflow
VariCAD EN up to and including version 2010-2.05 is vulnerable to a stack-based buffer overflow when parsing .dwb drawing files. The application fails to properly validate the length of input data embedded in the file, allowing a crafted .dwb file to overwrit…
-
High 8.4CVE-2010-20123 Public exploit
Steinberg MyMP3Player <= 3.0.0.67 Buffer Overflow
Steinberg MyMP3Player version 3.0 (build 3.0.0.67) is vulnerable to a stack-based buffer overflow when parsing .m3u playlist files. The application fails to properly validate the length of input data within the playlist, allowing a specially crafted file to o…
-
High 8.5CVE-2010-20007 Public exploit
Seagull FTP v3.3 Build 409 Stack Buffer Overflow
Seagull FTP Client <= v3.3 Build 409 contains a stack-based buffer overflow vulnerability in its FTP directory listing parser. When the client connects to an FTP server and receives a crafted response to a LIST command containing an excessively long filename,…
-
High 8.4CVE-2009-20002 Public exploit
Millenium MP3 Studio <= 2.0 .pls File Stack-Based Buffer Overflow
Millenium MP3 Studio versions up to and including 2.0 is vulnerable to a stack-based buffer overflow when parsing .pls playlist files. The application fails to properly validate the length of the File1 field within the playlist, allowing an attacker to craft …
-
High 8.5CVE-2010-20034 Public exploit
Gekko Manager FTP Client <= 0.77 Stack Buffer Overflow
Gekko Manager FTP Client <= 0.77 contains a stack-based buffer overflow in its FTP directory listing parser. When processing a server response to a LIST command, the client fails to properly validate the length of filenames. A crafted response containing an o…
-
High 8.4CVE-2009-20004 Public exploit
gAlan <= 0.2.1 Buffer Overflow
gAlan 0.2.1, a modular audio processing environment for Windows, is vulnerable to a stack-based buffer overflow when parsing .galan files. The application fails to properly validate the length of input data, allowing a specially crafted file to overwrite the …
-
High 8.4CVE-2010-20108 Public exploit
FTPPad <= 1.2.0 Stack Buffer Overflow
FTPPad <= 1.2.0 contains a stack-based buffer overflow vulnerability in its FTP directory listing parser. When the client connects to an FTP server and receives a crafted response to a LIST command containing an excessively long directory and filename, the ap…
-
High 8.5CVE-2010-20107 Public exploit
FTP Synchronizer Professional <= 4.0.73.274 Stack Buffer Overflow
A stack-based buffer overflow exists in FTP Synchronizer Professional <= v4.0.73.274. When the client connects to an FTP server and issues a LIST command—typically during sync preview or profile creation—the server’s response containing an overly long filenam…
-
High 8.4CVE-2010-20111 Public exploit
Digital Music Pad <= 8.2.3.3.4 Stack Buffer Overflow
Digital Music Pad v8.2.3.3.4 contains a stack-based buffer overflow vulnerability in its playlist file parser. When opening a .pls file containing an excessively long string in the File1 field, the application fails to properly validate input length, resultin…
-
High 8.6CVE-2010-20119 Public exploit
CommuniCrypt Mail <= 1.16 ANSMTP/AOSMTP ActiveX Control Buffer Overflow
CommuniCrypt Mail versions up to and including 1.16 contains a stack-based buffer overflow vulnerability in its ANSMTP.dll and AOSMTP.dll ActiveX controls, specifically within the AddAttachments() method. This method fails to properly validate the length of i…
-
High 8.4CVE-2010-10015 Public exploit
AOL <= 9.5 Phobos.Playlist 'Import()' Stack-Based Buffer Overflow
AOL versions up to and including 9.5 includes an ActiveX control (Phobos.dll) that exposes a method called Import() via the Phobos.Playlist COM object. This method is vulnerable to a stack-based buffer overflow when provided with an excessively long string ar…