Skip to content
OpenAdvisories

Weakness (CWE)

CWE-562: Return of Stack Variable Address

Variant Draft

A function returns the address of a stack variable.

More detail

Because local variables are allocated on the stack, when a program returns a pointer to a local variable, it is returning a stack address. A subsequent function call is likely to re-use this same stack address, thereby overwriting the value of the pointer, which no longer corresponds to the same variable since a function's stack frame is invalidated when it returns. At best this will cause the value of the pointer to change unexpectedly. In many cases it causes the program to crash the next time the pointer is dereferenced.

How to prevent it (1 mitigation)

  1. Implementation

    Fix the code so that it does not return a stack address.

Source: MITRE CWE-562

All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Medium 5.3
    CVE-2026-26399 Public exploit

    A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() functio…

    arduino Ubuntu
  • Medium 4.0
    CVE-2026-34553

    iccDEV: DoS in CIccCLUT::Iterate() & CIccMBB::Describe()

    iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a defect in LUT dump/iteration logic affecting CIccCLUT::Iterate() and output produced by CIccMBB::Describe() (via CLUT dumping). T…

    InternationalColorConsortium iccDEV
  • Medium 5.4
    CVE-2026-3591

    A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass

    A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Alpine
  • High 8.4
    CVE-2024-33045

    Return of Stack Variable Address in Buses

    Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

    Qualcomm Snapdragon
  • Medium 6.2
    CVE-2024-4418

    Libvirt: stack use-after-free in virnetclientioeventloop()

    A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOE…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  • Unscored —
    CVE-2020-21686

    A stack-use-after-scope issue discovered in expand_mmac_params function in preproc.c in nasm before 2.15.04 allows remo…

    nasm nasm Debian Ubuntu
  • Critical 9.8
    CVE-2022-41837

    An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Proj…

    OpenImageIO Project OpenImageIO openimageio openimageio Debian Ubuntu
  • High 8.8
    CVE-2021-21798 EPSS 21%

    An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF.…