CWE-121: Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Consequences

• Availability: Modify Memory, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
• Integrity, Confidentiality, Availability, Access Control: Modify Memory, Execute Unauthorized Code or Commands, Bypass Protection Mechanism
• Integrity, Confidentiality, Availability, Access Control, Other: Modify Memory, Execute Unauthorized Code or Commands, Bypass Protection Mechanism, Other

How to prevent it

• Operation, Build and Compilation: Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
• Architecture and Design: Use an abstraction library to abstract away risky APIs. Not a complete solution.
• Implementation: Implement and perform bounds checking on input.
• Implementation: Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
• Operation, Build and Compilation: Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code. Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking. For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].

Recent advisories

• CVE-2021-27137 — An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724.
• GHSA-mmjf-rqrv-855v — Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability
• GHSA-3v45-f3vh-wg7m — Oj: Stack Buffer Overflow in Oj.dump via Large Indent
• CVE-2026-7273 — A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based,…
• GHSA-ghm9-cr32-g9qj — rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check
• GHSA-98cp-rj9f-6v5g — ImageMagick has has a stack-buffer-overflow in MNG encoder with oversized pallete
• GHSA-6588-8gv4-xfgh — Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability
• GHSA-8793-7xv6-82cf — ImageMagick has an Out-of-bounds Write via InterpretImageFilename
• GHSA-rqq8-jh93-f4vg — ImageMagick has stack buffer overflow in MagnifyImage
• GHSA-7h7q-j33q-hvpf — ImageMagick has stack write buffer overflow in MNG encoder
• GHSA-932h-jw47-73jm — ImageMagick vulnerable to stack corruption through long morphology kernel names or arrays
• GHSA-3mwp-xqp2-q6ph — ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.
• GHSA-72hf-fj62-w6j4 — ImageMagick: Stack buffer overflow in FTXT reader via oversized integer field
• CVE-2025-53521 — When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).
• CVE-2025-20352 — A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following: An…

All advisories for CWE-121