Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-121 (栈缓冲区溢出) — Vulnerability Class 2518

2518 vulnerabilities classified as CWE-121 (栈缓冲区溢出). AI Chinese analysis included.

CWE-121 represents a critical memory safety weakness where program data exceeds the allocated bounds of a stack-allocated buffer, corrupting adjacent memory structures. Attackers typically exploit this vulnerability by injecting malicious payloads that overwrite the function’s return address or saved frame pointer, thereby hijacking control flow to execute arbitrary code with the privileges of the compromised process. This exploitation is particularly dangerous because stack buffers are local variables, making the attack surface common in low-level languages like C and C++. Developers mitigate this risk by enforcing strict input validation, utilizing safe string handling functions that prevent unbounded writes, and adopting modern programming languages with automatic memory management. Additionally, implementing compiler-level protections such as stack canaries and Address Space Layout Randomization significantly raises the barrier for successful exploitation, ensuring system integrity remains intact against buffer overflow attempts.

MITRE CWE Description
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Common Consequences (3)
AvailabilityModify Memory, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Integrity, Confidentiality, Availability, Access ControlModify Memory, Execute Unauthorized Code or Commands, Bypass Protection Mechanism
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy.
Integrity, Confidentiality, Availability, Access Control, OtherModify Memory, Execute Unauthorized Code or Commands, Bypass Protection Mechanism, Other
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
Mitigations (5)
Operation, Build and CompilationUse automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses…
Effectiveness: Defense in Depth
Architecture and DesignUse an abstraction library to abstract away risky APIs. Not a complete solution.
ImplementationImplement and perform bounds checking on input.
ImplementationDo not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
Operation, Build and CompilationRun or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code. Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported…
Effectiveness: Defense in Depth
Examples (2)
While buffer overflow examples can be rather complex, it is possible to have very simple, yet still exploitable, stack-based buffer overflows:
#define BUFSIZE 256 int main(int argc, char **argv) { char buf[BUFSIZE]; strcpy(buf, argv[1]); }
Bad · C
This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.
void host_lookup(char *user_supplied_addr){ struct hostent *hp; in_addr_t *addr; char hostname[64]; in_addr_t inet_addr(const char *cp); /*routine that ensures user_supplied_addr is in the right format for conversion */ validate_addr_form(user_supplied_addr); addr = inet_addr(user_supplied_addr); hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET); strcpy(hostname, hp->h_name); }
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2010-20107 FTP Synchronizer Professional <= 4.0.73.274 Stack Buffer Overflow — FTP Synchronizer Professional 8.8AIHighAI2025-08-21
CVE-2010-20113 EasyFTP Server list.html path Stack Buffer Overflow — EasyFTP Server 9.8AICriticalAI2025-08-21
CVE-2010-20121 EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow — EasyFTP Server 9.8AICriticalAI2025-08-21
CVE-2010-20111 Digital Music Pad <= 8.2.3.3.4 Stack Buffer Overflow — Digital Music Pad 7.8AIHighAI2025-08-21
CVE-2010-20119 CommuniCrypt Mail <= 1.16 ANSMTP/AOSMTP ActiveX Control Buffer Overflow — CommuniCrypt Mail 9.1AICriticalAI2025-08-21
CVE-2010-10015 AOL <= 9.5 Phobos.Playlist 'Import()' Stack-Based Buffer Overflow — AOL 7.8AIHighAI2025-08-21
CVE-2010-20112 Amlibweb NetOpacs webquery.dll Stack Buffer Overflow — Amlibweb Library Management System 9.8AICriticalAI2025-08-21
CVE-2025-9300 saitoha libsixel img2sixel encoder.c sixel_debug_print_palette stack-based overflow — libsixel 5.3 Medium2025-08-21
CVE-2025-9299 Tenda M3 getMasterPassengerAnalyseData formGetMasterPassengerAnalyseData stack-based overflow — M3 8.8 High2025-08-21
CVE-2025-9298 Tenda M3 QuickIndex formQuickIndex stack-based overflow — M3 8.8 High2025-08-21
CVE-2025-9297 Tenda i22 wxportalauth formWeixinAuthInfoGet stack-based overflow — i22 8.8 High2025-08-21
CVE-2025-9253 Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP_doSpecifySiteSurvey stack-based overflow — RE6250 8.8 High2025-08-20
CVE-2025-9252 Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 DisablePasswordAlertRedirect stack-based overflow — RE6250 8.8 High2025-08-20
CVE-2025-9251 Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 sta_wps_pin stack-based overflow — RE6250 8.8 High2025-08-20
CVE-2025-9250 Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setPWDbyBBS stack-based overflow — RE6250 8.8 High2025-08-20
CVE-2025-9249 Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 DHCPReserveAddGroup stack-based overflow — RE6250 8.8 High2025-08-20
CVE-2025-9248 Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP_pingGatewayByBBS stack-based overflow — RE6250 8.8 High2025-08-20
CVE-2025-9247 Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setVlan stack-based overflow — RE6250 8.8 High2025-08-20
CVE-2025-9246 Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 check_port_conflict stack-based overflow — RE6250 8.8 High2025-08-20
CVE-2025-9245 Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 WPSSTAPINEnr stack-based overflow — RE6250 8.8 High2025-08-20
CVE-2010-20010 Foxit PDF Reader < 4.2.0.0928 Title Stack Buffer Overflow — Foxit PDF Reader 8.8AIHighAI2025-08-20
CVE-2010-20042 Xion Audio Player ≤ 1.0.126 Unicode Stack Buffer Overflow — Audio Player 7.8AIHighAI2025-08-20
CVE-2010-10014 Odin Secure FTP <= 4.1 Stack Buffer Overflow via LIST Response — Odin Secure FTP 9.8AICriticalAI2025-08-20
CVE-2011-10023 MJM QuickPlayer <= 2010 .s3m Stack-Based Buffer Overflow — QuickPlayer 7.8AIHighAI2025-08-20
CVE-2011-10024 MJM Core Player 2011 .s3m File Stack-Based Buffer Overflow — Core Player 7.8AIHighAI2025-08-20
CVE-2011-10021 Magix Musik Maker <= v16 .mmm Stack-Based Buffer Overflow — Magix Musik Maker 7.8AIHighAI2025-08-20
CVE-2010-20049 LeapFTP < 3.1.x Stack Buffer Overflow — LeapFTP 8.8AIHighAI2025-08-20
CVE-2010-20045 FileWrangler <= 5.30 Stack Buffer Overflow — FileWrangler 9.8AICriticalAI2025-08-20
CVE-2011-10027 AOL Desktop 9.6 RTX Stack-Based Buffer Overflow — AOL Desktop 7.8AIHighAI2025-08-20
CVE-2025-32010 Tenda AC6 安全漏洞 — AC6 V5.0 8.1 High2025-08-20

Vulnerabilities classified as CWE-121 (栈缓冲区溢出) represent 2518 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.