CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

BaseIncompleteExploit Likelihood: High

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

View on MITRE
Back to CWE Lookup

Technical Details

Structure
Simple

Applicable To

Languages
CC++Memory-UnsafeAssembly
Platforms

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine review and analysis around the CWE-120 trust boundary

MITRE identifies automated static analysis, automated dynamic analysis, manual analysis as applicable detection approaches. Use them to review copies into fixed-size buffers, determine the real destination capacity, and test length arithmetic, terminators, truncation, and error handling. Require a reproducible source-to-sink or policy-to-enforcement trace, record coverage gaps, and confirm suspected findings dynamically where safe; no single scanner can establish complete coverage for this weakness.

CWE-120: detection methods and operational guidanceMITRE CWE

Eliminate classic buffer overflows through memory-safe design

Prefer a memory-safe language for new components and migrate exposed memory-unsafe code where practical. Where unsafe code remains, establish destination capacity before every copy, check size arithmetic and terminators, enable compiler and runtime memory-safety defenses, and test empty, maximum-length, and one-past-the-end inputs. Treat mitigations as transitional controls rather than substitutes for removing the defect class.

Secure by Design Alert: Eliminating Buffer Overflow VulnerabilitiesCISA

Apply lessons from CVE-2020-15069 in Sophos XG Firewall

NVD maps CVE-2020-15069 to CWE-120; a classic buffer-overflow condition in the HTTP/S bookmark feature could be exploited for remote code execution. Use the case to prioritize internet-facing appliance parsers, remove unbounded copies, and fuzz administrative features under memory-safety instrumentation even when they appear secondary.

CVE-2020-15069 DetailNIST National Vulnerability Database

Prioritize CWE-120 using its 2025 CWE Top 25 evidence

CWE-120 ranked #11 in the 2025 CWE Top 25 with a score of 6.96. The ranking table recorded no mapped vulnerabilities in CISA KEV for this measurement window. Use the rank to prioritize systemic prevention, detection coverage, and recurring-root-cause metrics across the portfolio, while retaining asset exposure and business impact for individual finding severity decisions.

2025 CWE Top 25 Most Dangerous Software WeaknessesMITRE CWE

Exercise classic copy boundaries under AddressSanitizer

Instrument native components with AddressSanitizer and drive every fixed-buffer copy with empty, exact-fit, missing-terminator, one-byte-too-large, and maximum protocol inputs. Cover conversion and error paths as well as the normal parser. Retain crashing inputs as regressions and combine sanitizer results with review of destination capacity and integer conversions because dynamic tests only protect executed paths.

AddressSanitizerLLVM Project

Frequently Asked Questions

What is CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')?+

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

What are the security consequences of Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')?+

If exploited, CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')) it can compromise Integrity, Confidentiality and Availability, leading to outcomes such as Modify Memory, Execute Unauthorized Code or Commands, DoS: Crash, Exit, or Restart and DoS: Resource Consumption (CPU).

How do you prevent or mitigate Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')?+

Recommended mitigations for CWE-120 include: Most mitigating technologies at the compiler or OS level to date address only a subset of buffer overflow problems and rarely provide complete protection against even that subset. It is good practice to implement strategies to increase the workload of an attacker, such as leaving the attacker to guess an unknown value that changes every program execution.

How is Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') detected?+

CWE-120 can be detected using Automated Static Analysis - Binary or Bytecode, Manual Static Analysis - Binary or Bytecode, Dynamic Analysis with Automated Results Interpretation, Dynamic Analysis with Manual Results Interpretation, Manual Static Analysis - Source Code and Automated Static Analysis - Source Code. Combining automated tooling with manual review typically yields the best coverage.

Which programming languages are affected by Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')?+

CWE-120 commonly affects C, C++, Memory-Unsafe and Assembly. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')?+

MITRE documents real CVEs mapped to CWE-120, including CVE-2000-1094, CVE-1999-0046, CVE-2002-1337, CVE-2003-0595 and CVE-2001-0191. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-120 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

Learn More

Advertisement