Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-120 (未进行输入大小检查的缓冲区拷贝(传统缓冲区溢出)) — Vulnerability Class 1767

1767 vulnerabilities classified as CWE-120 (未进行输入大小检查的缓冲区拷贝(传统缓冲区溢出)). AI Chinese analysis included.

CWE-120 represents a critical memory safety vulnerability where software copies data into a fixed-size buffer without validating the input’s length against the destination’s capacity. This classic buffer overflow occurs when an attacker supplies input exceeding the allocated memory space, causing data to spill into adjacent memory regions. Exploitation typically involves injecting malicious code or altering program control flow, such as overwriting return addresses to execute arbitrary commands. Developers prevent this weakness by implementing rigorous bounds checking before any copy operation, ensuring the input size never exceeds the buffer’s limits. Utilizing safer, language-specific functions that automatically handle size verification, or adopting modern programming languages with built-in memory safety features, effectively mitigates this risk and preserves application integrity against memory corruption attacks.

MITRE CWE Description
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
Common Consequences (2)
Integrity, Confidentiality, AvailabilityModify Memory, Execute Unauthorized Code or Commands
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of the product's implicit security policy. This can often be used to subvert any other security service.
AvailabilityModify Memory, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the product into an infinite loop.
Mitigations (5)
RequirementsUse a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a lan…
Architecture and DesignUse a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.
Operation, Build and CompilationUse automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses…
Effectiveness: Defense in Depth
ImplementationConsider adhering to the following rules when allocating and managing an application's memory: Double check that your buffer is as large as you specify. When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string. Check buffer boundaries if accessing the buffer i…
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Examples (2)
The following code asks the user to enter their last name and then attempts to store the value entered in the last_name array.
char last_name[20]; printf ("Enter your last name: "); scanf ("%s", last_name);
Bad · C
The following code attempts to create a local copy of a buffer to perform some manipulations to the data.
void manipulate_string(char * string){ char buf[24]; strcpy(buf, string); ... }
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2025-12345 LLM-Claw Agent Deployment initiate.c agent_deploy_init buffer overflow — LLM-Claw 8.8 High2026-03-03
CVE-2026-20436 MediaTek Chipsets 安全漏洞 — MediaTek chipset 6.7AIMediumAI2026-03-02
CVE-2026-3399 Tenda F453 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflow — F453 8.8 High2026-03-01
CVE-2026-3398 Tenda F453 httpd AdvSetWan fromAdvSetWan buffer overflow — F453 8.8 High2026-03-01
CVE-2026-3380 Tenda F453 L7Im frmL7ImForm buffer overflow — F453 8.8 High2026-03-01
CVE-2026-3379 Tenda F453 SetIpBind fromSetIpBind buffer overflow — F453 8.8 High2026-03-01
CVE-2026-3378 Tenda F453 qossetting fromqossetting buffer overflow — F453 8.8 High2026-03-01
CVE-2026-3377 Tenda F453 SafeUrlFilter fromSafeUrlFilter buffer overflow — F453 8.8 High2026-02-28
CVE-2026-3376 Tenda F453 SafeMacFilter fromSafeMacFilter buffer overflow — F453 8.8 High2026-02-28
CVE-2026-3275 Tenda F453 httpd addressNat fromAddressNat buffer overflow — F453 8.8 High2026-02-27
CVE-2026-3274 Tenda F453 httpd L7Prot frmL7ProtForm buffer overflow — F453 8.8 High2026-02-27
CVE-2026-3273 Tenda F453 httpd AdvSetWrlsafeset formWrlsafeset buffer overflow — F453 8.8 High2026-02-27
CVE-2026-3272 Tenda F453 httpd DhcpListClient fromDhcpListClient buffer overflow — F453 8.8 High2026-02-27
CVE-2026-3271 Tenda F453 httpd P2pListFilterof fromP2pListFilter buffer overflow — F453 8.8 High2026-02-27
CVE-2026-27942 fast-xml-parser has stack overflow in XMLBuilder with preserveOrder — fast-xml-parser 7.5AIHighAI2026-02-26
CVE-2026-3169 Tenda F453 httpd SafeEmailFilter fromSafeEmailFilter buffer overflow — F453 8.8 High2026-02-25
CVE-2026-3168 Tenda F453 httpd NatStaticSetting fromNatStaticSetting buffer overflow — F453 8.8 High2026-02-25
CVE-2026-3167 Tenda F453 httpd webtypelibrary formWebTypeLibrary buffer overflow — F453 8.8 High2026-02-25
CVE-2026-3166 Tenda F453 httpd RouteStatic fromRouteStatic buffer overflow — F453 8.8 High2026-02-25
CVE-2026-3165 Tenda F453 httpd AdvSetWrlsafeset fromSetWifiGusetBasic buffer overflow — F453 8.8 High2026-02-25
CVE-2026-3016 UTT HiPER 810G formP2PLimitConfig strcpy buffer overflow — HiPER 810G 8.8 High2026-02-23
CVE-2026-3015 UTT HiPER 810G formPolicyRouteConf strcpy buffer overflow — HiPER 810G 8.8 High2026-02-23
CVE-2026-2981 UTT HiPER 810G formTaskEdit_ap strcpy buffer overflow — HiPER 810G 8.8 High2026-02-23
CVE-2026-2980 UTT HiPER 810G setSysAdm strcpy buffer overflow — HiPER 810G 7.2 High2026-02-23
CVE-2026-2935 UTT HiPER 810G ConfigExceptMSN strcpy buffer overflow — HiPER 810G 7.2 High2026-02-22
CVE-2026-2911 Tenda FH451 GstDhcpSetSer buffer overflow — FH451 8.8 High2026-02-22
CVE-2026-2904 UTT HiPER 810G ConfigExceptAli strcpy buffer overflow — HiPER 810G 8.8 High2026-02-22
CVE-2026-2034 Sante DICOM Viewer Pro DCM File Parsing Buffer Overflow Remote Code Execution Vulnerability — DICOM Viewer Pro 7.8AIHighAI2026-02-20
CVE-2019-25354 iSmartViewPro 1.3.34 - Denial of Service — iSmartViewPro 7.5 High2026-02-18
CVE-2019-25353 Foscam Video Management System 1.1.4.9 - 'Username' Denial of Service — Foscam Video Management System 7.5 High2026-02-18

Vulnerabilities classified as CWE-120 (未进行输入大小检查的缓冲区拷贝(传统缓冲区溢出)) represent 1767 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.