cve.bz

CWE-121: Stack-based Buffer Overflow, page 4

Filter

The product writes past the end of a buffer that was allocated on the stack.

What the weakness is: CWE-121 at MITRE

Ask an AI about CWE-121

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-121: Stack-based Buffer Overflow and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/121.html and https://cve.bz/cve/cwe/121?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-96995EPSS 0.3%

    Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally.

  2. 7.5CVE-2026-96248EPSS 1.1%

    Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network.

  3. 8.8CVE-2026-88166EPSS 0.9%

    Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  4. 9.8CVE-2026-88156EPSS 1.2%

    Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  5. 7.8CVE-2026-87711EPSS 0.2%

    Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

  6. 8.0CVE-2026-85881EPSS 0.7%

    Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.

  7. 9.8CVE-2026-85806EPSS 0.9%

    Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.

  8. 7.8CVE-2026-85796EPSS 0.3%

    Numeric truncation error in Windows Installer allows an authorized attacker to elevate privileges locally.

  9. 8.8CVE-2026-83934EPSS 0.9%

    Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

  10. 8.8CVE-2026-83891EPSS 0.9%

    Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  11. 7.5CVE-2026-83860EPSS 1.3%

    Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.

  12. 7.8CVE-2026-83857EPSS 0.4%

    Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

  13. 7.8CVE-2026-83767EPSS 0.3%

    Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

  14. 7.0CVE-2026-83708EPSS 0.3%

    Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

  15. 7.8CVE-2026-83699EPSS 0.4%

    Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.

  16. 8.8CVE-2026-83643EPSS 0.9%

    Stack-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.

  17. 8.1CVE-2026-70571EPSS 1.4%

    Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

  18. 4.2CVE-2026-70116EPSS 0.4%

    Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to bypass a security feature with a physical attack.

  19. 7.8CVE-2026-70110EPSS 0.5%

    Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.

  20. 8.8CVE-2026-70069EPSS 1.0%

    Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.

  21. 9.8CVE-2026-70024EPSS 1.0%

    Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.

  22. 7.3CVE-2026-105732EPSS 0.5%

    Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally.

  23. 6.5CVE-2026-102199EPSS 0.9%

    Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to deny service over a network.

  24. 7.0CVE-2026-100216EPSS 0.3%

    Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.

  25. 7.1CVE-2026-97333EPSS 0.2%

    QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.

  26. 5.1CVE-2026-109940EPSS 0.1%

    FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider. It hex-encodes a key's CKA_ID, which can be up to 64 bytes, into a fixed 128-byt…

  27. 7.3CVE-2026-65148EPSS 0.1%

    NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.

  28. 5.9CVE-2026-109833EPSS 0.4%

    A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of …

  29. 8.6CVE-2026-109157EPSS 0.6%

    A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overfl…

  30. 8.7CVE-2026-102076EPSS 0.4%

    A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BA…

  31. 8.7CVE-2026-102075EPSS 0.4%

    A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BA…

  32. 8.7CVE-2026-102074EPSS 0.4%

    A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BA…

  33. 9.3CVE-2026-109109EPSS 0.6%

    A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_CO…

  34. 8.1CVE-2026-85457EPSS 0.4%

    IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.

  35. 6.5CVE-2026-53922EPSS 0.6%

    odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and th…

  36. 8.2CVE-2026-96266EPSS 0.1%

    IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to …

  37. 8.2CVE-2026-96264EPSS 0.1%

    IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message …

  38. 8.2CVE-2026-96263EPSS 0.1%

    IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to…

  39. 8.2CVE-2026-96262EPSS 0.1%

    IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message t…

  40. 7.3CVE-2026-96261EPSS 0.10%

    IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configur…

  41. 5.5CVE-2026-104332EPSS 0.10%

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table

  42. 8.6CVE-2026-108893EPSS 0.5%

    A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be laun…

  43. 9.3CVE-2026-108892EPSS 0.6%

    A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_text_%d causes stac…

  44. 9.8CVE-2026-66086EPSS 0.5%

    In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privi…

  45. 5.4CVE-2026-104115EPSS 0.1%

    A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in usr/src/cmd/fs.d/nfs/rp_basic/libnfs_basic.c, part of the nfs-basic reparse plugin, copies the host…

  46. 9.2CVE-2026-7827EPSS 0.6%

    A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for ex…

  47. 6.8CVE-2026-107736EPSS 0.1%

    SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem() while supplying only a fixed 64-byte buf on the stack.…

  48. 7.1CVE-2026-105673EPSS 0.3%

    An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corr…

  49. 9.8CVE-2026-84035EPSS 0.4%

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.

  50. 8.3CVE-2026-107705EPSS 0.3%

    Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a passwor…