cve.bz

CWE-121: Stack-based Buffer Overflow, page 11

Filter

The product writes past the end of a buffer that was allocated on the stack.

What the weakness is: CWE-121 at MITRE

Ask an AI about CWE-121

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-121: Stack-based Buffer Overflow and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/121.html and https://cve.bz/cve/cwe/121?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-62877EPSS 0.3%

    Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.

  2. 8.8CVE-2026-62824EPSS 0.8%

    Stack-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

  3. 8.1CVE-2026-62792EPSS 0.7%

    Stack-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to execute code over a network.

  4. 7.8CVE-2026-62768EPSS 0.3%

    Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

  5. 7.8CVE-2026-62755EPSS 0.3%

    Stack-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges locally.

  6. 8.3CVE-2026-24911EPSS 0.6%

    Stack-based buffer overflow for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack…

  7. 6.8CVE-2026-73070EPSS 0.2%

    Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to overflow fd_set structures in src/cha…

  8. 1.9CVE-2026-11735EPSS 0.8%

    A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality.

  9. 1.1CVE-2026-11734EPSS 0.9%

    A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable.

  10. 1.1CVE-2026-11733EPSS 0.8%

    A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the normal operation of the affected device.

  11. 7.3CVE-2026-59086EPSS 0.2%

    A vulnerability has been identified in Simcenter Femap (All versions < V2606), Simcenter Nastran (All versions < V2606). The affected applications contain a stack overflow vulnerability while parsing specially strings as argument for one o…

  12. 5.3CVE-2026-40130EPSS 0.5%

    SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands. An unauthenticated attacker could send specially crafted requests that trigger a buffer overflow in the affected component. This causes a temp…

  13. 8.8CVE-2025-15683EPSS 0.6%

    TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application dat…

  14. 6.6CVE-2026-6791EPSS 0.2%

    When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the…

  15. 9.8CVE-2026-68159EPSS 0.7%

    In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overfl…

  16. 8.4CVE-2026-21068EPSS 0.2%

    Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code.

  17. 7.4CVE-2026-19341EPSS 0.6%

    A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/pptpSrvGlobalConfig. Such manipulation of the argument EncryptionMode leads to stack-based buffer overf…

  18. 7.5CVE-2026-20345EPSS 0.6%

    A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of&nbsp;memory corruption on an affected device. This vulner…

  19. 5.5CVE-2026-55980EPSS 0.1%

    A denial-of-service vulnerability in CatchPulse could allow an attacker to conduct a stack buffer overrun attack, leading to a denial-of-service condition.

  20. 5.6CVE-2026-18909EPSS 0.1%

    A stack-based buffer overflow vulnerability exists in ELAN Microelectronics Corp. ELAN Smart-Pad on Windows (ETD.sys and ETDSMBus.sys). During Intel SMBus recovery, ETDSMBus.sys does not enforce an upper-bound check on the hardware-derived…

  21. 7.5CVE-2026-67866EPSS 0.8%

    Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse and SOPC_StaMac_NewDeleteMonitoredItems in the client wrapper DeleteMo…

  22. 9.8CVE-2026-71267EPSS 0.6%

    microtar's mtar_write_file_header and mtar_write_dir_header functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) i…

  23. 7.8CVE-2026-71266EPSS 0.2%

    tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplic…

  24. 7.5CVE-2026-71265EPSS 0.3%

    Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length chec…

  25. 9.8CVE-2026-61486EPSS 0.8%Unsupported when assigned

    Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternati…

  26. 7.4CVE-2026-18898EPSS 0.8%

    A security flaw has been discovered in UTT HiPER 1200GW up to v2.5.3-170306. This affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the argument timestart results in stack-based buffer overflow. The attack …

  27. 7.4CVE-2026-18897EPSS 0.8%

    A vulnerability was identified in UTT HiPER 1250GW up to v3.2.7-210907-180535. The impacted element is the function strcpy of the file /goform/getOneApConfTempEntry. The manipulation of the argument tempName leads to stack-based buffer ove…

  28. 7.4CVE-2026-18895EPSS 0.8%

    A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity_5g. Performing a manipulation of the argument cipher results in stack-based buffer overflow. It is poss…

  29. 8.7CVE-2026-45809EPSS 0.6%

    OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher…

  30. 9.8CVE-2026-45538EPSS 0.8%

    OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routin…

  31. 9.3CVE-2026-49435EPSS 1.4%

    Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet and execute arbitrary code with administrative privileges.

  32. 9.3CVE-2017-20242EPSS 1.3%

    Keysight IxChariot Endpoint before 9.5.102 contains a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet to crash the endpoint or potentially execute arbitrary code.

  33. 9.6CVE-2026-25289EPSS 0.2%

    Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.

  34. 7.8CVE-2026-10710EPSS 0.2%

    A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the conte…

  35. 7.8CVE-2026-10709EPSS 0.2%

    A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A malicious actor can leverage this vulnerability to execute arbitrary…

  36. 4.6CVE-2026-67673EPSS 0.2%

    A stack-based buffer overflow vulnerability exists in the cmd_edl function of OreSat Firmware v1.0. The vulnerability is triggered when processing the edl fw_flash command, where the <filename> argument is copied to a 64-byte stack buffer …

  37. 7.4CVE-2026-18607EPSS 0.8%

    A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the fil…

  38. 8.9CVE-2026-18589EPSS 1.1%

    A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed …

  39. 9.3CVE-2026-18588EPSS 1.1%

    A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENT_LENGTH leads to stack-based buffer overflow. Remote exploitation of the atta…

  40. 9.8CVE-2026-67822EPSS 0.5%

    Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer with…

  41. 7.5CVE-2026-15722EPSS 0.8%

    A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bou…

  42. 9.2CVE-2026-43832EPSS 0.6%

    A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled.

  43. 9.2CVE-2026-43831EPSS 0.6%

    A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code execution.

  44. 9.2CVE-2026-43829EPSS 0.6%

    A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled.

  45. 7.8CVE-2026-10535EPSS 0.2%

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc.

  46. 7.0CVE-2026-11771EPSS 0.4%

    OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server

  47. 5.4CVE-2026-7260EPSS 0.1%

    Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* b…

  48. 8.7CVE-2026-67248EPSS 0.5%

    A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly validated before being decoded and copied into a fixed-size stack buffer. An auth…

  49. 6.8CVE-2026-13309EPSS 0.3%

    Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elit…

  50. 7.8CVE-2026-5056EPSS 0.3%

    GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to ex…