CWE-121: Stack-based Buffer Overflow

Code Examples & CVEs

Demonstrative Examples

While buffer overflow examples can be rather complex, it is possible to have very simple, yet still exploitable, stack-based buffer overflows:

The buffer size is fixed, but there is no guarantee the string in argv[1] will not exceed this size and cause an overflow.

BadC

#define BUFSIZE 256int main(int argc, char **argv) {char buf[BUFSIZE];strcpy(buf, argv[1]);}

This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.

This function allocates a buffer of 64 bytes to store the hostname, however there is no guarantee that the hostname will not be larger than 64 bytes. If an attacker specifies an address which resolves to a very large hostname, then the function may overwrite sensitive data or even relinquish control flow to the attacker.

BadC

void host_lookup(char *user_supplied_addr){                         struct hostent *hp;in_addr_t *addr;char hostname[64];in_addr_t inet_addr(const char *cp);                                                        /*routine that ensures user_supplied_addr is in the right format for conversion */                                                        validate_addr_form(user_supplied_addr);addr = inet_addr(user_supplied_addr);hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET);strcpy(hostname, hp->h_name);                      }

Observed CVE Examples (1)

CVE-2021-35395

Stack-based buffer overflows in SFK for wifi chipset used for IoT/embedded devices, as exploited in the wild per CISA KEV.

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine review and analysis around the CWE-121 trust boundary

MITRE identifies fuzzing, automated static analysis, automated dynamic analysis as applicable detection approaches. Use them to identify fixed-size local arrays and prove every write, copy, format operation, and terminator remains within the stack object. Require a reproducible source-to-sink or policy-to-enforcement trace, record coverage gaps, and confirm suspected findings dynamically where safe; no single scanner can establish complete coverage for this weakness.

CWE-121: detection methods and operational guidance — MITRE CWE

Remove stack-buffer overflow paths instead of relying on crash defenses

Use a memory-safe language for new code and migrate externally reachable memory-unsafe components where feasible. For remaining stack buffers, prove bounds before copies and writes, check size calculations, replace unbounded interfaces, and test boundary-length inputs with static and runtime memory-safety tooling. Compiler hardening can limit exploitation but does not correct the underlying out-of-bounds access.

Secure by Design Alert: Eliminating Buffer Overflow Vulnerabilities — CISA

Apply lessons from CVE-2025-22457 in Ivanti Connect Secure, Policy Secure, and ZTA Gateways

NVD maps CVE-2025-22457 to CWE-121; a stack-based buffer overflow exposed to unauthenticated remote input could lead to remote code execution. Use the case to prioritize pre-authentication appliance code, fuzz protocol boundaries, and treat a stack crash as a potential control-flow compromise requiring immediate remediation.

CVE-2025-22457 Detail — NIST National Vulnerability Database

Prioritize CWE-121 using its 2025 CWE Top 25 evidence

CWE-121 ranked #14 in the 2025 CWE Top 25 with a score of 5.75. The ranking table recorded 4 mapped vulnerabilities in CISA KEV for this measurement window. Use the rank to prioritize systemic prevention, detection coverage, and recurring-root-cause metrics across the portfolio, while retaining asset exposure and business impact for individual finding severity decisions.

2025 CWE Top 25 Most Dangerous Software Weaknesses — MITRE CWE

Fuzz stack-buffer boundaries under AddressSanitizer

Build native targets with AddressSanitizer and fuzz each parser or protocol field copied into a local array. Include exact-fit, one-byte-too-large, missing-terminator, nested, and maximum-size values plus error paths. Preserve stack traces and crashing inputs, then verify the fix removes the fixed buffer or proves capacity before each write; stack canaries alone do not establish memory safety.

AddressSanitizer — LLVM Project

Frequently Asked Questions

What is CWE-121: Stack-based Buffer Overflow?+

CWE-121: Stack-based Buffer Overflow is a Common Weakness Enumeration (CWE) entry maintained by MITRE. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

What are the security consequences of Stack-based Buffer Overflow?+

If exploited, CWE-121 (Stack-based Buffer Overflow) it can compromise Availability, Integrity, Confidentiality, Access Control and Other, leading to outcomes such as Modify Memory, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), Execute Unauthorized Code or Commands and Bypass Protection Mechanism.

How do you prevent or mitigate Stack-based Buffer Overflow?+

Recommended mitigations for CWE-121 include: Use an abstraction library to abstract away risky APIs. Not a complete solution. Implement and perform bounds checking on input. Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.

Which programming languages are affected by Stack-based Buffer Overflow?+

CWE-121 commonly affects C, C++ and Memory-Unsafe. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Stack-based Buffer Overflow?+

MITRE documents real CVEs mapped to CWE-121, including CVE-2021-35395. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-121 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-121: Stack-based Buffer Overflow

Technical Details

Applicable To

Security Consequences

Scope

Impact

Scope

Impact

Scope

Impact

Mitigation Strategies

Phase

Description

Phase

Description

Phase

Description

Detection Methods

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (1)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Combine review and analysis around the CWE-121 trust boundary

Remove stack-buffer overflow paths instead of relying on crash defenses

Apply lessons from CVE-2025-22457 in Ivanti Connect Secure, Policy Secure, and ZTA Gateways

Prioritize CWE-121 using its 2025 CWE Top 25 evidence

Fuzz stack-buffer boundaries under AddressSanitizer

Frequently Asked Questions

Learn More