Stack-based Buffer Overflow
CWE-121
The product writes past the end of a buffer that was allocated on the stack.
We track 2,424 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.6. 20 have been exploited in real attacks.
How this weakness is prevented
- Operation Build and Compilation: Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.
- Architecture and Design: Use an abstraction library to abstract away risky APIs. Not a complete solution.
- Implementation: Implement and perform bounds checking on input.
- Implementation: Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
Latest Stack-based Buffer Overflow vulnerabilities
- 8.8 High severity
HiPER 1200GW: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/formFireWall. This manipulation of the argument Profile causes stack-based buffer overflow. Remote exploitation of the attack is possible. The ex
- 8.8 High severity
HiPER 1200GW: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in UTT HiPER 1200GW up to 2.5.3-170306. This affects the function strcpy of the file /goform/formTaskEdit. The manipulation results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and
- 7.8 High severity
Red Hat Enterprise Linux 10: Stack-based Buffer Overflow
A flaw was found in rrdcached, a component of rrdtool. A local attacker with access to a rrdcached socket can exploit a stack-based buffer overflow by sending an oversized CREATE request. This vulnerability can lead to a denial of service by crashing the daemo
- 8.8 High severity
microtar: Stack-based Buffer Overflow
microtar through 0.1.0 contains a stack-based buffer overflow vulnerability in the raw_to_header() function in src/microtar.c that allows attackers to corrupt adjacent stack memory by supplying a crafted TAR archive with non-null-terminated name or linkname fi
- 7.5 High severity
DI-7001 MINI: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in D-Link DI-7001 MINI up to 19.09.19A1. Impacted is the function sprintf of the file /httpd_debug.asp of the component API. The manipulation of the argument Time results in stack-based buffer overflow. The attack may be performed
- 8.8 High severity
Magic B0: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in H3C Magic B0 up to 100R002. The affected element is the function SetMobileAPInfoById of the file /goform/aspForm. Such manipulation of the argument param leads to stack-based buffer overflow. The attack may be perf
- 9.2 Critical severity
poly_trio_8300: Stack-based Buffer Overflow
In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.
- 8.8 High severity
DI-8400: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in D-Link DI-8400 up to 16.07.26A1. This affects an unknown function of the file /dbsrv.asp. Performing a manipulation of the argument str results in stack-based buffer overflow. Remote exploitation of the attack is possible. The e
- 8.8 High severity
W12: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in Tenda W12 3.0.0.7(4763). The affected element is the function set_local_time_0 of the file /bin/httpd. Such manipulation of the argument Time leads to stack-based buffer overflow. The attack can be launched remotely. The explo
- 8.8 High severity
W12: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was determined in Tenda W12 3.0.0.7(4763). Impacted is the function cgiWifiMacFilterSet of the file /bin/httpd. This manipulation of the argument wifiMacFilterSet.macList.mac causes stack-based buffer overflow. The attack can be initiated remot
- 8.8 High severity
W12: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in Tenda W12 3.0.0.7(4763). This vulnerability affects the function cgiSysTimeInfoSet of the file /bin/httpd. The manipulation of the argument sec leads to stack-based buffer overflow. It is possible to initiate the attack remote
- 8.8 High severity
W12: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in Tenda W12 3.0.0.7(4763). This affects the function cgistaKickOff of the file /bin/httpd. Executing a manipulation of the argument staMac can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has
- 9.8 Critical severity
N300RH: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in Totolink N300RH 6.1c.1353_B20190305. Affected by this issue is the function setWiFiBasicConfig of the file wireless.so of the component Web Management Interface. Performing a manipulation of the argument KeyStr results in stack-
- 8.8 High severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in TRENDnet TEW-432BRP 3.10B20. This affects the function formWlanSetup of the file /goform/formWlanSetup. The manipulation of the argument enrollee leads to stack-based buffer overflow. The attack may be initiated remotely. The
- 8.8 High severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. The affected element is the function formSysCmd of the file /goform/formSysCmd. Performing a manipulation of the argument submit-url results in stack-based buffer overflow. The attack can be initiated r
- 8.8 High severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in TRENDnet TEW-432BRP 3.10B20. This issue affects the function formSetWlanEncrypt of the file /goform/formSetWlanEncrypt. This manipulation of the argument webpage causes stack-based buffer overflow. It is possible to initiate the attack
- 8.8 High severity
BR-6478AC: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in Edimax BR-6478AC 1.23. The impacted element is the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component POST Request Handler. Such manipulation of the argument pppUserName leads to stack-based buff
- 8.8 High severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in TRENDnet TEW-432BRP 3.10B20. This vulnerability affects the function formSetPassword of the file /goform/formSetPassword. Executing a manipulation of the argument webpage can lead to stack-based buffer overflow. The attack may be launc
- 8.8 High severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in TRENDnet TEW-432BRP 3.10B20. This affects the function formResetStatistic of the file /goform/formResetStatistic. Performing a manipulation of the argument status_statistic results in stack-based buffer overflow. The attack may
- 8.8 High severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in TRENDnet TEW-432BRP 3.10B20. Affected by this issue is the function formSetEnableWizard of the file /goform/formSetEnableWizard. Such manipulation of the argument start_wizard leads to stack-based buffer overflow.
- 8.8 High severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A weakness has been identified in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formSysLog of the file /goform/formSysLog. This manipulation of the argument current_page causes stack-based buffer overflow. The attack can be initia
- 8.8 High severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security flaw has been discovered in TRENDnet TEW-432BRP 3.10B20. Affected is the function formPortFw of the file /goform/formPortFw. The manipulation of the argument server_name results in stack-based buffer overflow. It is possible to launch the attack rem
- 8.8 High severity
BR-6478AC: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in Edimax BR-6478AC 1.23. Affected by this vulnerability is the function formPPPoESetup of the file /goform/formPPPoESetup of the component POST Request Handler. The manipulation of the argument pppUserName leads to stack-based b
- 8.8 High severity
Tomato: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was determined in Shibby Tomato up to 1.28. Affected is the function rip_zebra_read_ipv4 of the file /usr/sbin/ripd of the component Zserv Handler. Executing a manipulation can lead to stack-based buffer overflow. It is possible to launch the a
- 8.8 High severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. This impacts the function formSetDomainFilter of the file /goform/formSetDomainFilter. Performing a manipulation of the argument blocked_domain/permitted_domain/blocked_domain_list/permitted_domain_list
- 8.8 High severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in TRENDnet TEW-432BRP 3.10B20. This affects the function formSetProtocolFilter of the file /goform/formSetProtocolFilter. Such manipulation of the argument protocol_name leads to stack-based buffer overflow. The attack may be pe
- 8.8 High severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in TRENDnet TEW-432BRP 3.10B20. The impacted element is the function formSetUrlFilter of the file /goform/formSetUrlFilter. This manipulation of the argument keyword_list/keyword causes stack-based buffer overflow. The attack is possible
- 8.8 High severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in TRENDnet TEW-432BRP 3.10B20. The affected element is the function formSetFirewallRule of the file /goform/formSetFirewallRule. The manipulation of the argument firewall_name results in stack-based buffer overflow. The attack can
- 8.8 High severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in TRENDnet TEW-432BRP 3.10B20. Impacted is the function formSetMACFilter of the file /goform/formSetMACFilter. The manipulation of the argument filter_name leads to stack-based buffer overflow. Remote exploitation of
- 8.8 High severity
Tomato: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in Shibby Tomato 1.28. Impacted is the function sub_90F0 of the file multimon.cgi. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. This project is superseded by FreshTomato. This vulner
- 8.8 High severity
Tomato: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in Shibby Tomato up to 1.28. This issue affects the function sub_9068 of the file tomatoups.cgi of the component UPS Service. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely
- 8.8 High severity
Tomato: Improper Restriction of Operations within the Bounds of a Memory Buffer
A weakness has been identified in Shibby Tomato 1.28. This vulnerability affects the function get_ups_field of the file tomatodata.cgi. Executing a manipulation of the argument Date can lead to stack-based buffer overflow. It is possible to launch the attack r
- 9.8 Critical severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security flaw has been discovered in TRENDnet TEW-432BRP 3.10B20. This affects the function formSetPortTr of the file /goform/formSetPortTr. Performing a manipulation of the argument special_name results in stack-based buffer overflow. It is possible to init
- 9.8 Critical severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in TRENDnet TEW-432BRP 3.10B20. Affected by this issue is the function formWPS of the file /goform/formWPS. Such manipulation of the argument peerPin leads to stack-based buffer overflow. The attack may be performed from remote.
- 9.8 Critical severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was determined in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formSetRoute of the file /goform/formSetRoute. This manipulation of the argument ip/mask/gateway causes stack-based buffer overflow. The attack is pos
- 7.8 High severity
OpenSC: Stack-based Buffer Overflow
OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by supplying a crafted profile configuration file. During p
- 8.6 High severity
C6: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability in the charging controller’s signal-processing logic allows an attacker with physical access to the charging interface to supply message fields that exceed expected bounds. Because the input is not sufficiently valid
- 7.5 High severity
CryptX: Stack-based Buffer Overflow
CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers. The gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication
- 8.8 High severity
Aspera High-Speed Transfer Endpoint: Stack-based Buffer Overflow
IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a buffer overflow in the asperahttpd component. This vul
- 8.8 High severity
HiPER 1250GW: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this issue is the function strcpy of the file /goform/formGroupConfig of the component Web Management Interface. Executing a manipulation of the argument Profile can lead to stack