What is Stack-based Buffer Overflow (CWE-121)?

TL;DR: A stack-based buffer overflow occurs when an attacker overflows a buffer allocated on the stack, allowing them to execute arbitrary code.

At-a-Glance

What is Stack-based Buffer Overflow?

Stack-based buffer overflow (CWE-121) is a type of vulnerability that occurs when an attacker overflows a buffer allocated on the stack, allowing them to execute arbitrary code. As defined by the MITRE Corporation under CWE-121 (not directly mapped to a specific OWASP Top 10:2025 category), this vulnerability can lead to crashes, data corruption, and unauthorized access to sensitive information.

Quick Summary

Stack-based buffer overflow (CWE-121) is a critical security issue that requires immediate attention. It occurs when an attacker overflows a buffer allocated on the stack, allowing them to execute arbitrary code. The common consequences of CWE-121 include modify memory, DoS: crash, exit, or restart, DoS: resource consumption (CPU), and DoS: resource consumption (memory). To prevent CWE-121, use automatic buffer overflow detection mechanisms, validate user input, and follow secure coding practices.

Jump to: Quick Summary · Stack-based Buffer Overflow Overview · How Stack-based Buffer Overflow Works · Business Impact of Stack-based Buffer Overflow · Stack-based Buffer Overflow Attack Scenario · How to Detect Stack-based Buffer Overflow · How to Fix Stack-based Buffer Overflow · Framework-Specific Fixes for Stack-based Buffer Overflow · How to Ask AI to Check Your Code for Stack-based Buffer Overflow · Stack-based Buffer Overflow Best Practices Checklist · Stack-based Buffer Overflow FAQ · Vulnerabilities Related to Stack-based Buffer Overflow · References · Scan Your Own Site

Stack-based Buffer Overflow Overview

What: CWE-121 is a type of vulnerability that occurs when an attacker overflows a buffer allocated on the stack, allowing them to execute arbitrary code.

Why it matters: CWE-121 can lead to crashes, data corruption, and unauthorized access to sensitive information. It is a critical security issue that requires immediate attention.

Where it occurs: CWE-121 can occur in any application that uses buffers allocated on the stack.

Who is affected: Any user who interacts with an application that has CWE-121 can be affected.

Who is NOT affected: Users who do not interact with applications that have CWE-121 are not affected.

How Stack-based Buffer Overflow Works

Root Cause

A stack-based buffer overflow occurs when an attacker overflows a buffer allocated on the stack, allowing them to execute arbitrary code.

Attack Flow

1. The attacker sends a malicious input to the application.
2. The application allocates a buffer on the stack to store the input.
3. The attacker overflows the buffer by sending more data than it can hold.
4. The overflowed buffer allows the attacker to execute arbitrary code.

Prerequisites to Exploit

• The attacker must send a malicious input to the application.
• The application must allocate a buffer on the stack to store the input.
• The buffer must be overflowing, allowing the attacker to execute arbitrary code.

Vulnerable Code

void vulnerable_function(char *input) {
  char buffer[10];
  strcpy(buffer, input);
}

The vulnerable code allocates a buffer on the stack and uses strcpy to copy user input into it. This allows an attacker to overflow the buffer by sending more data than it can hold.

Secure Code

void secure_function(char *input) {
  char buffer[10];
  strncpy(buffer, input, sizeof(buffer));
  buffer[sizeof(buffer) - 1] = '\0';
}

The secure code allocates a buffer on the stack and uses strncpy to copy user input into it. It also checks for buffer overflow by ensuring that the input is not longer than the buffer size.

Business Impact of Stack-based Buffer Overflow

Confidentiality: CWE-121 can lead to unauthorized access to sensitive information, including passwords, credit card numbers, and personal identifiable information.

Integrity: CWE-121 can lead to data corruption, allowing an attacker to modify or delete sensitive data.

Availability: CWE-121 can lead to crashes, causing the application to become unavailable.

The business impact of CWE-121 includes:

• Financial losses due to unauthorized access to sensitive information
• Compliance issues due to failure to protect sensitive data
• Reputation damage due to public disclosure of security vulnerabilities

Stack-based Buffer Overflow Attack Scenario

1. The attacker sends a malicious input to the application.
2. The application allocates a buffer on the stack to store the input.
3. The attacker overflows the buffer by sending more data than it can hold.
4. The overflowed buffer allows the attacker to execute arbitrary code.

How to Detect Stack-based Buffer Overflow

Manual Testing

• Review the application’s source code for potential vulnerabilities.
• Use a debugger to identify areas where buffers are allocated on the stack.
• Test the application with malicious inputs to see if it crashes or behaves unexpectedly.

Automated Scanners (SAST / DAST)

• Use automated scanners to identify potential buffer overflow vulnerabilities in the application’s source code.
• These scanners can also detect other types of security vulnerabilities, including SQL injection and cross-site scripting.

PenScan Detection

PenScan’s scanner engines actively test for CWE-121 by sending malicious inputs to the application and monitoring its behavior.

False Positive Guidance

When detecting CWE-121 with automated scanners or manual testing, be aware that some false positives may occur. These can be caused by legitimate code that uses buffers allocated on the stack in a way that is not vulnerable to overflow attacks.

How to Fix Stack-based Buffer Overflow

• Use automatic buffer overflow detection mechanisms, such as the Microsoft Visual Studio /GS flag.
• Validate user input to prevent overflowing buffers.
• Follow secure coding practices, including using strncpy instead of strcpy.

Framework-Specific Fixes for Stack-based Buffer Overflow

Java

public class SecureFunction {
  public void execute(String input) {
    char[] buffer = new char[10];
    input.getChars(0, Math.min(input.length(), 10), buffer, 0);
  }
}

Node.js

function secureFunction(input) {
  const buffer = Buffer.alloc(10);
  input.slice(0, 10).copy(buffer);
}

Python/Django

def secure_function(input):
  buffer = bytearray(10)
  input[:10].to_bytes(len(input), 'big', buffer)

PHP

function secureFunction($input) {
  $buffer = str_split(substr($input, 0, 10));
}

How to Ask AI to Check Your Code for Stack-based Buffer Overflow

To ask AI to check your code for CWE-121, provide a copy-pasteable prompt with the relevant code block and ask it to rewrite the code using a primary fix technique.

Stack-based Buffer Overflow Best Practices Checklist

✅ Use automatic buffer overflow detection mechanisms. ✅ Validate user input to prevent overflowing buffers. ✅ Follow secure coding practices, including using strncpy instead of strcpy.

Stack-based Buffer Overflow FAQ

How does a stack-based buffer overflow occur?

A stack-based buffer overflow occurs when an attacker overflows a buffer allocated on the stack, allowing them to execute arbitrary code.

What are the common consequences of CWE-121?

The common consequences of CWE-121 include modify memory, DoS: crash, exit, or restart, DoS: resource consumption (CPU), and DoS: resource consumption (memory).

How can I prevent CWE-121 in my applications?

You can prevent CWE-121 by using automatic buffer overflow detection mechanisms, such as the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice.

What are some common frameworks that use stack-based buffer overflow protection?

Some common frameworks that use stack-based buffer overflow protection include Java, Python, and Node.js.

How can I detect CWE-121 in my applications?

You can detect CWE-121 by using automated scanners (SAST / DAST) or manual testing.

What are some common mistakes to avoid when fixing CWE-121?

Some common mistakes to avoid when fixing CWE-121 include not using automatic buffer overflow detection mechanisms, not validating user input, and not using secure coding practices.

How can I ask AI to check my code for CWE-121?

You can ask AI to check your code for CWE-121 by providing a copy-pasteable prompt with the relevant code block and asking it to rewrite the code using a primary fix technique.

Vulnerabilities Related to Stack-based Buffer Overflow

References

• MITRE CWE-121
• CAPEC
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Stack-based Buffer Overflow and other risks before an attacker does.