Buffer Copy without Checking Size of Input
CWE-120
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
We track 2,043 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.6. 24 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega, and the Strsafe.h library from Microsoft. These libraries provide safer versions of overflow-prone string-handling functions.
- Operation Build and Compilation: Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.
- Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
- Operation: Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment. For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND.
Latest Buffer Copy without Checking Size of Input vulnerabilities
- 9.6 Critical severity
ArubaOS (AOS): Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker
- 9.6 Critical severity
ArubaOS (AOS): Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker
- 9.8 Critical severity
ArubaOS (AOS): Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful expl
- 9.8 Critical severity
ArubaOS (AOS): Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system
- 9.5 Critical severity
EDK2: Buffer Copy without Checking Size of Input
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It cou
- 9.9 Critical severity
BE3L Pro: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security_5g causes buffer overflow. It is possible to initiate the attack r
- 7.5 High severity
ADAM-3600: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.
- 9.6 Critical severity
RIOT: Buffer Copy without Checking Size of Input
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the des
- 7.5 High severity
SL902-SWTGW124AS: Buffer Copy without Checking Size of Input
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Att
- 8.8 High severity
Junos OS: Buffer Copy without Checking Size of Input
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending s
- 8.0 High severity
Zoom Workplace: Buffer Copy without Checking Size of Input
Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.
- 8.2 High severity
AptioV: Buffer Copy without Checking Size of Input
AMI APTIOV contains vulnerabilities in BIOS where users may cause “Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confiden
- 9.9 Critical severity
BR-6208AC: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of the argument ateBW leads to buffer overflow. The attack can be executed remotely. The exploit has been disclosed to the p
- 9.9 Critical severity
BR-6208AC: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The explo
- 8.8 High severity
zephyr: Buffer Copy without Checking Size of Input
The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the static Broadcast Audio Scan Service parameter structure mod_src_param without any bounds check. In base
- 7.8 High severity
Fabric OS: Buffer Copy without Checking Size of Input
A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First (FSPF) protocol component of Brocade Fabric OS versions before 10.0.1. While this code path is part of internal diagno
- 7.8 High severity
ClearPass Policy Manager (CPPM): Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an authenticated local user to execute arbitrary code with elevated privileges on the affected host or to disrupt the availability of t
- 9.1 Critical severity
AOS-Switch (AOS-S): Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to expose sensitive memory contents and cause a denial of service on the device.
- 9.3 Critical severity
AOS-Switch (AOS-S): Buffer Copy without Checking Size of Input
An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory contents and cause a denial of service on the affected device.
- 9.8 Critical severity
AOS-Switch (AOS-S): Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code.
- 8.7 High severity
Fireware OS: Buffer Copy without Checking Size of Input
A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP pack
- 9.6 Critical severity
Instant ON: Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary comman
- 9.8 Critical severity
ADC: Buffer Copy without Checking Size of Input
Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 le
- 7.8 High severity
Concert: Buffer Copy without Checking Size of Input
IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
- 9.9 Critical severity
NBR200V2: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlan_load_form_uci of the file /usr/bin/routerd. The manipulation of the argument wan_num leads to buffer overflow. It is possible to initiat
- 9.9 Critical severity
NBR200V2: Improper Restriction of Operations within the Bounds of a Memory Buffer
A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. Impacted is the function wan_config_set_vlan of the file /usr/bin/routerd of the component WAN VLAN Reconfiguration. Executing a manipulation of the argument vlan_wanX.ports can lead to buff
- 10.0 Critical severity
A3002MU: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possible to launch
- 10.0 Critical severity
A3002MU: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely
- 9.9 Critical severity
A3002MU: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed from remote. The
- 9.9 Critical severity
A3002MU: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possible to be carried out rem
- 7.2 High severity
EdgeConnect SD-WAN Gateways: Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlying operating system.
- 8.1 High severity
EdgeConnect SD-WAN Gateways: Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's cont
- 8.2 High severity
EdgeConnect SD-WAN Gateways: Buffer Copy without Checking Size of Input
A vulnerability in the network security monitoring component of intrusion detection systems could allow an unauthenticated remote attacker to exploit a limited buffer overflow. Successful exploitation could allow an attacker to cause a denial-of-service or pot
- 9.8 Critical severity
EdgeConnect SD-WAN Gateways: Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to execute arbitrary code. Successful exploitation could allow an attacker to execute arb
- 8.8 High severity
Android: Buffer Copy without Checking Size of Input
In DecodeFilmGrainParams of film_grain_dec.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.8 High severity
Android: Buffer Copy without Checking Size of Input
In gmc_phy_lp3_exit_restore_registers of phy_power.c, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploi
- 8.4 High severity
Android: Buffer Copy without Checking Size of Input
In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 8.0 High severity
Android: Buffer Copy without Checking Size of Input
In decodeAmr of ImsMediaAudioPlayer.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.
- 8.8 High severity
Android: Buffer Copy without Checking Size of Input
In IP Multimedia Subsystem, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- 8.4 High severity
Android: Buffer Copy without Checking Size of Input
In Wave6VpuDecFlush of wave6.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.