Skip to content
OpenAdvisories

Weakness (CWE)

CWE-562: Return of Stack Variable Address

Variant Draft

A function returns the address of a stack variable.

More detail

Because local variables are allocated on the stack, when a program returns a pointer to a local variable, it is returning a stack address. A subsequent function call is likely to re-use this same stack address, thereby overwriting the value of the pointer, which no longer corresponds to the same variable since a function's stack frame is invalidated when it returns. At best this will cause the value of the pointer to change unexpectedly. In many cases it causes the program to crash the next time the pointer is dereferenced.

How to prevent it (1 mitigation)

  1. Implementation

    Fix the code so that it does not return a stack address.

Source: MITRE CWE-562

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2026-26399 Public exploit

    A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() functio…

    arduino Ubuntu