Stack-based Buffer Overflow
CWE-121
The product writes past the end of a buffer that was allocated on the stack.
We track 2,424 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.6. 20 have been exploited in real attacks.
How this weakness is prevented
- Operation Build and Compilation: Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.
- Architecture and Design: Use an abstraction library to abstract away risky APIs. Not a complete solution.
- Implementation: Implement and perform bounds checking on input.
- Implementation: Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
Latest Stack-based Buffer Overflow vulnerabilities
- 8.8 High severity
HiPER 1250GW: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/formConfigFastDirectionW of the component Web Management Interface. Performing a manipulation of the argument
- 8.8 High severity
HiPER 1200GW: Improper Restriction of Operations within the Bounds of a Memory Buffer
A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is an unknown function of the file /goform/formPptpClientConfig of the component Web Management Interface. This manipulation of the argument PPTP server address/username/password/t
- 7.8 High severity
GDAL: Stack-based Buffer Overflow
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the
- 8.8 High severity
EW-7438RPn: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in Edimax EW-7438RPn 1.31. This impacts the function formSDHCP of the file /goform/formSDHCP. Such manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has
- 8.8 High severity
EW-7438RPn: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in Edimax EW-7438RPn 1.31. This affects the function formStats of the file /goform/formStats. This manipulation of the argument submit-url causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been publ
- 8.8 High severity
EW-7438RPn: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in Edimax EW-7438RPn 1.31. The impacted element is the function formrefresh of the file /goform/formrefresh. The manipulation of the argument submit-url results in stack-based buffer overflow. It is possible to launch the attack re
- 8.8 High severity
EW-7438RPn: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in Edimax EW-7438RPn 1.31. The affected element is the function formLogout of the file /goform/formLogout. The manipulation of the argument submit-url leads to stack-based buffer overflow. It is possible to initiate t
- 8.8 High severity
EW-7438RPn: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in Edimax EW-7438RPn 1.31. Affected by this issue is the function formLicence of the file /goform/formLicence. This manipulation of the argument submit-url causes stack-based buffer overflow. The attack may be initiated remotely. The expl
- 8.8 High severity
EW-7438RPn: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in Edimax EW-7438RPn 1.31. Affected by this vulnerability is the function formWpsProxyEnable of the file /goform/formWpsProxyEnable. The manipulation of the argument submit-url results in stack-based buffer overflow. The attack can
- 8.8 High severity
EW-7438RPn: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in Edimax EW-7438RPn 1.31. Affected is the function formRadius of the file /goform/formRadius. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be initiated remotely. Th
- 8.8 High severity
EW-7438RPn: Improper Restriction of Operations within the Bounds of a Memory Buffer
A weakness has been identified in Edimax EW-7438RPn 1.31. This impacts the function formAccept of the file /goform/formAccept. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. It is possible to launch the attack remo
- 8.8 High severity
EW-7438RPn: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security flaw has been discovered in Edimax EW-7438RPn 1.31. This affects the function formConnectionSetting of the file /goform/formConnectionSetting. Performing a manipulation of the argument max_Conn/timeOut results in stack-based buffer overflow. It is p
- 8.8 High severity
F1202: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in Tenda F1202 1.2.0.20(408). This affects the function fromPptpUserAdd of the file /goform/PptpUserAdd. The manipulation of the argument opttype leads to stack-based buffer overflow. The attack can be initiated remotely. The exp
- 8.8 High severity
F1202: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was determined in Tenda F1202 1.2.0.20(408). Affected by this issue is the function formGstDhcpSetSer of the file /goform/GstDhcpSetSerof. Executing a manipulation of the argument dips can lead to stack-based buffer overflow. It is possible to
- 8.8 High severity
F1202: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in Tenda F1202 1.2.0.20(408). Affected by this vulnerability is the function formWrlExtraSet of the file /goform/WrlExtraSet. Performing a manipulation of the argument delno results in stack-based buffer overflow. It is possible to in
- 8.8 High severity
F1202: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in Tenda F1202 1.2.0.20(408). Affected is the function fromPPTPUserSetting of the file /goform/PPTPUserSetting. Such manipulation of the argument delno leads to stack-based buffer overflow. The attack may be performed from remote
- 8.8 High severity
EW-7438RPn: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in Edimax EW-7438RPn 1.31. This impacts the function formWlSiteSurvey of the file /goform/formWlSiteSurvey of the component webs. This manipulation of the argument selSSID/submit-url causes stack-based buffer overflow. The attack is possi
- 8.8 High severity
EW-7438RPn: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in Edimax EW-7438RPn 1.31. This affects the function formHwSet of the file /goform/formHwSet. The manipulation of the argument Anntena/Mcs/regDomain/nic0Addr/nic1Addr/wlanAddr/wanAddr/wlanSSID/wlanChan/initgain/txcck/txofdm/submit-
- 8.8 High severity
EW-7438RPn: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in Edimax EW-7438RPn 1.31. The impacted element is the function formWlanMP of the file /goform/formWlanMP. The manipulation of the argument ateFunc/ateGain/ateTxCount/ateChan/ateRate/ateMacID/e2pTxPower1/e2pTxPower2/e
- 8.8 High severity
EW-7438RPn: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in Edimax EW-7438RPn up to 1.31. Affected by this vulnerability is an unknown functionality of the file /goform/mp of the component webs. The manipulation of the argument webs results in stack-based buffer overflow. It is possible to
- 8.8 High severity
EW-7438RPn: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in Edimax EW-7438RPn up to 1.31. The impacted element is an unknown function of the file /goform/formWpsStart of the component webs. Such manipulation of the argument pinCode/wlan-url leads to stack-based buffer overf
- 8.8 High severity
FreeBSD: Stack-based Buffer Overflow
libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select(2)'s descriptor set size limit of FD_SET
- 7.8 High severity
FreeBSD: Stack-based Buffer Overflow
The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer without first validating its length.
- 8.8 High severity
Netatalk: Stack-based Buffer Overflow
A stack-based buffer overflow via UCS-2 type confusion in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service.
- 9.8 Critical severity
lwIP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-ba
- 8.8 High severity
PostgreSQL: Improper Neutralization of Special Elements used in an SQL Command
Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refin
- 7.5 High severity
BIG-IP: Stack-based Buffer Overflow
When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 9.3 Critical severity
GUARDIANWALL MailSuite (On-premises version): Stack-based Buffer Overflow
Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version). If a remote attacker sends a specially crafted request to the product's web service, arbitrary code may be executed when the product
- 9.8 Critical severity
arduino-esp32: Stack-based Buffer Overflow
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer multipart form parser in arduino-esp32 allocates a Variable Length Array (VLA) on the stack whose size is derive
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Stack-based Buffer Overflow
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Stack-based Buffer Overflow
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Stack-based Buffer Overflow
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Stack-based Buffer Overflow
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Stack-based Buffer Overflow
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit
- 7.8 High severity
After Effects: Stack-based Buffer Overflow
After Effects is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 7.8 High severity
Windows 10 Version 1607: Stack-based Buffer Overflow
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Solid Edge SE2026: Stack-based Buffer Overflow
A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected applications contain a stack based overflow vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the con
- 7.5 High severity
iOS and iPadOS: Stack-based Buffer Overflow
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5
- 7.5 High severity
macOS: Stack-based Buffer Overflow
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.7, macOS Tahoe 26.5. A remote attacker may be able to cause unexpected system termination.
- 7.5 High severity
iOS and iPadOS: Stack-based Buffer Overflow
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker