CWE-121 Stack-based Buffer Overflow
variantA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (5113)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-27137US | —OT critical | KEV | ||
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a re… | ||||
| CVE-2026-7273US | —OT critical | KEV | ||
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to… | ||||
| CVE-2025-53521US | —OT critical | KEV | ||
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).
Note: Software versions which have reached… | ||||
| CVE-2025-20352US | —OT critical | KEV | ||
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following:
An authenticated, remote… | ||||
| CVE-2025-32756US | critical9.8OT critical | KEV | ||
A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMa… | ||||
| CVE-2025-42599US | critical9.8OT critical | KEV | ||
Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthe… | ||||
| CVE-2025-22457US | critical9.8OT critical | KEV | ||
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows… | ||||
| CVE-2025-0282US | critical9.0OT critical | KEV | ||
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.… | ||||
| CVE-2023-4911US | high7.8OT critical | KEV | ||
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to us… | ||||
| CVE-2022-20708US | high8.0OT critical | KEV | ||
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate pr… | ||||
| CVE-2022-20703US | high8.0OT critical | KEV | ||
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate pr… | ||||
| CVE-2022-20701US | high7.8OT critical | KEV | ||
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate pr… | ||||
| CVE-2022-20700US | critical9.8OT critical | KEV | ||
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate pr… | ||||
| CVE-2022-20699US | critical9.8OT critical | KEV | ||
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate pr… | ||||
| CVE-2021-20038US | critical9.8OT critical | KEV | ||
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute cod… | ||||
| CVE-2021-35395US | critical9.8OT critical | KEV | ||
Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this mana… | ||||
| CVE-2020-5735US | high8.8OT critical | KEV | ||
Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly exec… | ||||
| CVE-2018-5002US | high7.8OT critical | KEV | ||
Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context o… | ||||
| CVE-2014-9163US | high10.0OT critical | KEV | ||
Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to exe… | ||||
| CVE-2013-2597US | high7.2OT critical | KEV | ||
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) And… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan