Weakness (CWE)

CWE-121: Stack-based Buffer Overflow

Variant Draft

The product writes past the end of a buffer that was allocated on the stack.

How to prevent it (5 mitigations)

Operation, Build and Compilation

Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Architecture and Design

Use an abstraction library to abstract away risky APIs. Not a complete solution.
Implementation

Implement and perform bounds checking on input.
Implementation

Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
Operation, Build and Compilation

Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].

Source: MITRE CWE-121

All Critical High Medium Low Exploited only Public exploit

94 results · Clear filters · Feed

High 8.0

CVE-2021-27246 Public exploit

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Arc…

TP-Link Systems AC1750 Network devices

Apr 14, 2021
High 8.8

CVE-2020-27347 Public exploit

tmux stack buffer overflow in function input_csi_dispatch_sgr_colon

In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.

Ubuntu tmux tmux tmux Debian Ubuntu Alpine

Nov 6, 2020
High 8.8

CVE-2020-15416 Public exploit

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R670…

NETGEAR R6700 Network devices

Jul 28, 2020
High 8.8

CVE-2020-10924 Public exploit EPSS 87%

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R670…

NETGEAR R6700 Network devices

Jul 28, 2020
High 8.8

CVE-2020-5735 Exploited Public exploit EPSS 36%

Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attack…

Apr 8, 2020
KEV Nov 3, 2021
High 7.8

CVE-2019-0053 Public exploit

Junos OS: Insufficient validation of environment variables in telnet client may lead to stack-based buffer overflow

Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffer overflows, which can be exploited to bypass veriexec restrictions on Junos OS. A stack-based overflow is present in the handling of envir…

Juniper Networks Junos OS inetutils inetutils Network devices Debian Ubuntu

Jul 11, 2019
High 8.3

CVE-2017-15118 Public exploit EPSS 12%

A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a clien…

QEMU QEMU qemu Virtualization Debian

Jul 27, 2018
High 8.8

CVE-2017-13089 Public exploit EPSS 80%

GNU Wget: stack overflow in HTTP protocol handling

The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk len…

GNU wget wget wget Debian Ubuntu Alpine

Oct 27, 2017
High 8.4

CVE-2013-2597 Exploited Public exploit

Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.…

Aug 31, 2014
KEV Sep 15, 2022
High 7.5

CVE-2014-2364 Public exploit EPSS 61%

Advantech WebAccess Stack-Based Buffer Overflow

Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter…

Advantech WebAccess

Jul 19, 2014
High 8.3

CVE-2014-0782 Public exploit EPSS 57%

Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow

Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R3.09.50 and earlier, CENTUM VP R5.03.00 and earlier, CENTUM VP Entry Class R5.03.00 and earlier, Exaopc R3.71.02 and ea…

Yokogawa CENTUM CS 3000 ICS / OT

May 16, 2014
High 8.3

CVE-2014-0784 Public exploit EPSS 36%

Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow

Stack-based buffer overflow in BKBCopyD.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.

Yokogawa CENTUM CS 3000 ICS / OT

Mar 14, 2014
High 8.8

CVE-2008-0015 Exploited Public exploit EPSS 77%

Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used i…

Jul 7, 2009
KEV Feb 17, 2026
High 8.8

CVE-2009-0927 Exploited Public exploit EPSS 97%

Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows …

Mar 19, 2009
KEV Mar 25, 2022