Weakness (CWE)
CWE-121: Stack-based Buffer Overflow
The product writes past the end of a buffer that was allocated on the stack.
How to prevent it (5 mitigations)
-
Operation, Build and Compilation
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
-
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
-
Implementation
Implement and perform bounds checking on input.
-
Implementation
Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
-
Operation, Build and Compilation
Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Source: MITRE CWE-121
4,188 results · Feed
-
Critical 9.1
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality …
-
Critical 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functi…
-
Critical 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functi…
-
Critical 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functi…
-
Critical 9.1
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (v…
-
Critical 9.1
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (v…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOL…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTO…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLI…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLIN…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-…
-
High 8.6
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execu…
-
High 8.6
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated at…
-
High 8.6
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achiev…
-
Critical 9.2
A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code executio…
-
High 7.5
A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to…
-
High 8.2
Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corru…
-
High 8.8
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 …
-
Medium 6.5
H3C Magic NX15 usrlist sub_416874 stack-based overflow
A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has…
-
High 7.8
Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in th…
-
High 8.5CVE-2026-105810 Public exploit
Authenticated Local Stack Overflow in TP-Link Tapo C320WS
Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated attacker on the adjacent network can submit a crafted request containing an oversized encrypted password field, overwrite…
-
High 8.1
IBM MQ Buffer Overflow
IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.
-
Medium 6.1
libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a capt…
-
High 7.5
GV-ASManager Web Server Buffer Overflow Vulnerability
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .
-
Medium 5.9
libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hi
libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute …
-
Medium 5.9
lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answer…
-
Critical 9.8
Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can…
-
Critical 9.6
RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the de…
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 7.3
HPE NonStop XABroker - Memory corruption vulnerability
A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.
-
High 7.3
HPE NonStop ODBC/MX Server - Memory corruption vulnerability
A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash.
-
High 7.3
HPE NonStop ODBC/MX Services - Memory corruption vulnerability
A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash.
-
High 7.6
HPE NonStop SQL/MX Executor - Buffer overflow vulnerability
A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash.
-
Medium 6.6
HPE NonStop Kernel Level Thread Model Lib - Stack buffer overflow vulnerability
A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution.
-
Medium 4.0
HPE NonStop EMS Distributor - Buffer Overflow vulnerability
HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior.
-
Low 2.3
Stack-based Buffer Overflow in qsyncsrv.cgi
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerabili…
-
High 7.5
HPE NonStop TELSERV - Memory corruption vulnerability
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.