Skip to content
OpenAdvisories

Weakness (CWE)

CWE-562: Return of Stack Variable Address

Variant Draft

A function returns the address of a stack variable.

More detail

Because local variables are allocated on the stack, when a program returns a pointer to a local variable, it is returning a stack address. A subsequent function call is likely to re-use this same stack address, thereby overwriting the value of the pointer, which no longer corresponds to the same variable since a function's stack frame is invalidated when it returns. At best this will cause the value of the pointer to change unexpectedly. In many cases it causes the program to crash the next time the pointer is dereferenced.

How to prevent it (1 mitigation)

  1. Implementation

    Fix the code so that it does not return a stack address.

Source: MITRE CWE-562

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.4
    CVE-2024-33045

    Return of Stack Variable Address in Buses

    Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

    Qualcomm Snapdragon
  • High 8.8
    CVE-2021-21798 EPSS 21%

    An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF.…