Skip to content
OpenAdvisories

Weakness (CWE)

CWE-121: Stack-based Buffer Overflow

Variant Draft

The product writes past the end of a buffer that was allocated on the stack.

How to prevent it (5 mitigations)

  1. Operation, Build and Compilation

    Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.

    D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.

  2. Architecture and Design

    Use an abstraction library to abstract away risky APIs. Not a complete solution.

  3. Implementation

    Implement and perform bounds checking on input.

  4. Implementation

    Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.

  5. Operation, Build and Compilation

    Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.

    Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.

    For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].

Source: MITRE CWE-121

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-104945 Public exploit

    Authenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of Service in TP-Link Tapo C500

    TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond the bounds of fixed-size stack arrays and…

    TP-Link Systems Tapo C500 v2.0 Network devices
  • Medium 6.7
    CVE-2025-71384 Public exploit

    Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging…

  • Medium 6.3
    CVE-2026-49943 Public exploit

    CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask match…

    NIC BIRD bird bird2 Debian Ubuntu
  • Medium 6.2
    CVE-2026-29628 Public exploit

    A stack overflow in the experimental/tinyobj_loader_opt.h file of tinyobjloader commit d56555b allows attackers to caus…

    tinyobjloader Ubuntu
  • Medium 6.5
    CVE-2026-32743 Public exploit

    PX4 Autopilot: Stack-based Buffer Overflow via Oversized Path Input in MAVLink Log Request Handling

    PX4 is an open-source autopilot stack for drones and unmanned vehicles. Versions 1.17.0-rc2 and below are vulnerable to Stack-based Buffer Overflow through the MavlinkLogHandler, and are triggered via MAVLink log request. The LogEntry.filepath buffer is 60 by…

    PX4 PX4-Autopilot
  • Medium 5.2
    CVE-2026-32707 Public exploit

    PX4 autopilot has a stack buffer overflow in tattu_can due to unbounded memcpy in frame assembly loop

    PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, tattu_can contains an unbounded memcpy in its multi-frame assembly loop, allowing stack memory overwrite when crafted CAN frames are processed. In deployments where tattu_can is enabl…

    PX4 PX4-Autopilot
  • Medium 6.9
    CVE-2012-10023 Public exploit

    FreeFloat FTP Server USER Command Buffer Overflow

    A stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0. The server fails to properly validate input passed to the USER command, allowing remote attackers to overwrite memory and potentially execute arbitrary code. The flaw is…

    Freefloat FTP Server
  • Medium 5.3
    CVE-2014-125122 Public exploit

    Linksys WRT120N tmUnblock.cgi Stack-Based Buffer Overflow Admin Password Reset

    A stack-based buffer overflow vulnerability exists in the tmUnblock.cgi endpoint of the Linksys WRT120N wireless router. The vulnerability is triggered by sending a specially crafted HTTP POST request with an overly long TM_Block_URL parameter to the endpoint…

    Linksys WRT120N
  • Medium 6.5
    CVE-2023-31419 Public exploit EPSS 61%

    Elasticsearch StackOverflow vulnerability

    A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.

    Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven
  • Medium 5.5
    CVE-2022-1068 Public exploit

    Modbus Tools Modbus Slave Stack-Based Buffer Overflow

    Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field. This may cause the program to crash when a long character string is used.

    Modbus Tools Modbus Slave