cve.bz

CWE-121: Stack-based Buffer Overflow, page 19

Filter

The product writes past the end of a buffer that was allocated on the stack.

What the weakness is: CWE-121 at MITRE

Ask an AI about CWE-121

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-121: Stack-based Buffer Overflow and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/121.html and https://cve.bz/cve/cwe/121?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.6CVE-2026-42469EPSS 0.4%

    Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_canswitch.cpp the parser does not properly validate a CANswitch DLC value, allowing remote attackers to cause a denial of service or possibly e…

  2. 8.8CVE-2026-42468EPSS 0.4%

    Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_pcap.cpp , the parser's phdr.len field is not properly validated, allowing remote attackers to cause a denial of service or possibly execute ar…

  3. 10.0CVE-2026-37541EPSS 0.7%

    Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_gvret.cpp, the length field in GVRET binary data is not properly validated, allowing remote attackers to cause a denial of service or possibly …

  4. 9.8CVE-2026-37539EPSS 0.5%

    Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function parseCANFrame, and decoder.cpp in function decodeFrame allowing remote attackers to cause a denial of service (crash) or possibly execute arb…

  5. 7.5CVE-2026-37538EPSS 0.3%

    Buffer overflow vulnerability in socketcand 0.4.2 in file socketcand.c in function main allows attackers to cause a denial of service or other unspecified impacts via crafted bus_name.

  6. 8.8CVE-2026-37536EPSS 0.3%

    miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a (2016-10-05) contains a stack buffer overflow in send_diagnostic_request. A 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) receives memcpy at offset 1+pid_length with paylo…

  7. 7.5CVE-2026-37530EPSS 0.4%

    AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library. The send_diagnostic_request function in uds.c allocates a 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) but copies up to 7 bytes (MAX_U…

  8. 9.8CVE-2026-43037EPSS 0.7%

    In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv…

  9. 7.8CVE-2026-31772EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_create_sync() uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the …

  10. 9.8CVE-2026-42482EPSS 0.4%

    A stack-based buffer overflow in mangle_to_hex_lower() and mangle_to_hex_upper() in src/rp_cpu.c in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted rule file, or via the -j or…

  11. 10.0CVE-2026-42996EPSS 0.6%

    JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow via a radio transmission of @APRSIS GRID followed by a long Maidenhead locator. This occurs in grid2deg in APRSISClient.cpp.

  12. 8.9CVE-2026-7546EPSS 0.8%

    A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. The impacted element is the function find_host_ip of the component lighttpd. Such manipulation of the argument Host leads to stack-based buffer overflow.…

  13. 7.1CVE-2026-40950EPSS 0.2%

    CVE-2026-40950 is a buffer overflow vulnerability in the Secure Access server prior to 14.50. Attackers with control of a modified client can send a specially crafted message to the server and cause a denial of service

  14. 6.8CVE-2026-40949EPSS 0.1%

    CVE-2026-40949 is a buffer overflow vulnerability in the Secure Access Windows client prior to 14.50. Attackers with local control of the Windows client can use it to trigger a denial of service.

  15. 5.9CVE-2026-33452EPSS 0.10%

    CVE-2026-33452 is a buffer overflow vulnerability in the Secure Access Windows client prior to 14.50. Attackers with local control of the Windows client can use it to ‘blue screen’ the system.

  16. 2.3CVE-2026-33449EPSS 0.2%

    CVE-2026-33449 is a buffer overflow in a message handling function of the Secure Access client prior to 14.50. Attackers with control of a modified server can send a cryptographically valid message to the client, overwriting a small por…

  17. 2.3CVE-2026-33447EPSS 0.3%

    CVE-2026-33447 is a buffer overflow in a message parsing function of the Secure Access client prior to 14.50. Attackers with control of a modified server can send a special packet that can overwrite a small portion of memory conceivably…

  18. 7.8CVE-2026-39457EPSS 0.2%

    When exchanging data over a socket, libnv uses select(2) to wait for data to arrive. However, it does not verify whether the provided socket descriptor fits in select(2)'s file descriptor set size limit of FD_SETSIZE (1024). An attacker …

  19. 5.5CVE-2026-6538EPSS 0.2%

    BEEP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

  20. 5.5CVE-2026-6537EPSS 0.2%

    ZigBee protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

  21. 7.5CVE-2026-5654EPSS 0.2%

    AMR-NB codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

  22. 7.5CVE-2026-6868EPSS 0.2%

    HTTP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

  23. 7.4CVE-2026-7470EPSS 0.5%

    A flaw has been found in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. Affected is the function sub_427C3C of the file /goform/SafeMacFilter. This manipulation of the argument page causes stack-based buffer overflow. Remote exploitation of…

  24. 8.6CVE-2018-25303EPSS 0.2%

    Allok Video to DVD Burner 2.6.1217 contains a stack-based buffer overflow vulnerability in the License Name field that allows local attackers to execute arbitrary code by triggering a structured exception handler (SEH) overwrite. Attackers…

  25. 8.2CVE-2026-28221EPSS 0.4%

    Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.8.0 to before version 4.14.4, a stack-based buffer overflow exists in print_hex_string() in wazuh-remoted. The bug is triggered wh…

  26. 4.9CVE-2026-0206EPSS 0.5%

    A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewall.

  27. 7.5CVE-2026-36837EPSS 0.3%

    TOTOLINK A3002RU V3 <= V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the hostname parameter in the formMapDelDevice function.

  28. 7.4CVE-2026-7151EPSS 0.6%

    A vulnerability was determined in Tenda HG3 2.0. Impacted is the function formUploadConfig of the file /boaform/formIPv6Routing. This manipulation of the argument destNet causes stack-based buffer overflow. It is possible to initiate the a…

  29. 7.4CVE-2026-7035EPSS 0.6%

    A vulnerability was determined in Tenda FH1202 1.2.0.14. This affects the function fromWrlclientSet of the file /goform/WrlclientSet of the component httpd. Executing a manipulation of the argument Go can lead to stack-based buffer overflo…

  30. 7.4CVE-2026-7034EPSS 0.6%

    A vulnerability was found in Tenda FH1202 1.2.0.14(408). Affected by this issue is the function WrlExtraSet of the file /goform/WrlExtraSet of the component httpd. Performing a manipulation of the argument Go results in stack-based buffer …

  31. 8.8CVE-2026-41429EPSS 0.3%

    arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reachable memory corruption issue in the NBNS packet handling path. When NetBIOS is e…

  32. 8.1CVE-2026-41681EPSS 0.4%

    rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes…

  33. 7.8CVE-2026-31630EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc". …

  34. 9.8CVE-2026-1951EPSS 0.6%

    Delta Electronics AS320T has no checking of the length of the buffer with the directory name vulnerability.

  35. 9.8CVE-2026-1950EPSS 0.3%

    Delta Electronics AS320T has No checking of the length of the buffer with the file name vulnerability.

  36. 9.8CVE-2026-26354EPSS 0.5%

    Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.60, contain a stack-base…

  37. 8.1CVE-2026-40892EPSS 0.4%

    PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsip_auth_create_digest2() in PJSIP when using pre-computed digest credentials (PJSIP_CRED_DATA_DIGEST).…

  38. 10.0CVE-2017-20230EPSS 0.6%

    Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft dat…

  39. 6.7CVE-2026-26951EPSS 0.1%

    Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain a stack-based buffer overflow vulnerability. A high privileged attac…

  40. 8.6CVE-2026-6643EPSS 0.5%

    A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-controlled data directly to printf(). Due to the lack of PIE and Stack Canary protecti…

  41. 8.7CVE-2026-32955EPSS 0.6%

    SD-330AC and AMC Manager provided by silex technology, Inc. contain a stack-based buffer overflow vulnerability in processing the redirect URLs. Arbitrary code may be executed on the device.

  42. 8.6CVE-2026-40489EPSS 0.2%

    editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application …

  43. 7.5CVE-2026-40170EPSS 0.8%

    ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog …

  44. 9.3CVE-2026-6350EPSS 0.8%

    MailGates/MailAudit developed by Openfind has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's execution flow and execute arbitrary code.

  45. 8.7CVE-2026-4682EPSS 0.3%

    Certain HP DeskJet All in One devices may be vulnerable to remote code execution caused by a buffer overflow when specially crafted Web Services for Devices (WSD) scan requests are improperly validated and handled by the MFP. WSD Scan i…

  46. 7.5CVE-2026-30364EPSS 0.3%

    CentSDR commit e40795 was discovered to contain a stack overflow in the "Thread1" function.

  47. 7.5CVE-2026-32203EPSS 1.9%

    Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.

  48. 7.0CVE-2026-32195EPSS 0.2%

    Stack-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

  49. 5.3CVE-2026-5713EPSS 0.1%

    The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that proce…

  50. 7.4CVE-2026-6200EPSS 0.4%

    A vulnerability was determined in Tenda F456 1.0.0.5. The affected element is the function formwebtypelibrary of the file /goform/webtypelibrary. This manipulation of the argument menufacturer/Go causes stack-based buffer overflow. The att…