Buffer Overflow
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
How It Works
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions. This overwrites whatever data or code exists there, corrupting program state and potentially giving attackers control over execution flow.
Stack-based overflows are the most common variant. When a function allocates a fixed-size buffer on the stack and then copies user-controlled input without proper bounds checking, attackers can overflow past the buffer to overwrite the function's return address. When the function completes, instead of returning to legitimate code, execution jumps to attacker-specified memory containing malicious shellcode. Heap-based overflows work differently—they corrupt heap metadata like chunk size fields or free list pointers, leading to arbitrary memory writes when the allocator processes the corrupted structures.
Modern exploitation bypasses defensive mechanisms through techniques like Return-Oriented Programming (ROP), which chains together existing code snippets to avoid non-executable memory protections. Attackers may also use heap spraying to reliably position shellcode at predictable addresses, defeating address randomization.
Impact
- Remote code execution — attacker gains ability to run arbitrary commands with the privileges of the vulnerable process
- Privilege escalation — exploiting kernel or setuid program overflows to gain root/SYSTEM access
- Denial of service — crashes and memory corruption that render systems unusable
- Information disclosure — reading sensitive data from adjacent memory regions that should be inaccessible
- Authentication bypass — overwriting security-critical variables like permission flags or user IDs
Real-World Examples
Fortinet FortiOS suffered a critical buffer overflow (CVE-2025-32756) that allowed unauthenticated remote attackers to execute code as root on firewalls and VPN gateways. Attackers actively exploited this to compromise enterprise network perimeters before patches were available.
The Slammer worm from 2003 exploited a stack overflow in Microsoft SQL Server, spreading to 75,000 hosts in ten minutes by sending a single malformed UDP packet that overwrote the return address with shellcode. No authentication was required.
OpenSSH historically contained a heap overflow in challenge-response authentication that allowed pre-authentication remote root compromise on Unix systems, demonstrating how memory corruption in privileged network services creates maximum impact scenarios.
Mitigation
- Memory-safe languages — Rust, Go, and modern managed languages prevent buffer overflows by design through automatic bounds checking
- Stack canaries — random values placed before return addresses that detect corruption before control transfer
- Address Space Layout Randomization (ASLR) — randomizes memory locations making exploitation less reliable
- Data Execution Prevention (DEP/NX) — marks memory regions as non-executable, preventing direct shellcode execution
- Bounds checking — validate input sizes before copying, use safe functions like
strncpyinstead ofstrcpy - Fuzzing and static analysis — automated testing to discover overflows before deployment
Recent CVEs (36847)
Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available.
Multiple buffer overflows in Schneider Electric Modicon Quantum PLC allow remote attackers to cause a denial of service via malformed requests to the (1) FTP server or (2) HTTP server. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 12.5% and no vendor patch available.
Heap-based buffer overflow in the process_tx_desc function in the e1000 emulation (hw/e1000.c) in qemu-kvm 0.12, and possibly other versions, allows guest OS users to cause a denial of service (QEMU. Rated high severity (CVSS 7.4). No vendor patch available.
Stack-based buffer overflow in the suhosin_encrypt_single_cookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable. Public exploit code available.
Buffer overflow in Bip 0.8.8 and earlier might allow remote authenticated users to execute arbitrary code via vectors involving a series of TCP connections that triggers use of many open file. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Buffer overflow in the server in EMC NetWorker 7.5.x and 7.6.x before 7.6.3 SP1 Cumulative Release build 851 allows remote attackers to cause a denial of service (daemon crash) or possibly execute. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.
Heap-based buffer overflow in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via a crafted image in a chat message, as demonstrated using a PNG file. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.
Integer signedness error in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via crafted dimensions of a skin file, leading to a heap-based buffer overflow, as demonstrated using a. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.
Multiple integer overflows in vclmi.dll in the visual class library module in IBM Lotus Symphony before 3.0.1 might allow remote attackers to execute arbitrary code via an embedded (1) JPEG or (2). Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.
Stack-based buffer overflow in the JPEG2000 plugin in IrfanView PlugIns before 4.33 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 66.9%.
OpenSSL 0.9.8s and 1.0.0f does not properly support DTLS applications, which allows remote attackers to cause a denial of service (crash) via unspecified vectors related to an out-of-bounds read. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Integer overflow in the CYImage::LoadJPG method in YImage.dll in Yahoo!. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable. No vendor patch available.
Multiple stack-based buffer overflows in the NTR ActiveX control before 2.0.4.8 allow remote attackers to execute arbitrary code via (1) a long bstrUrl parameter to the StartModule method, (2) a long. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 73.7%.
Memory corruption in Adobe Reader and Acrobat 9.x-10.x PRC component allows remote code execution via malicious PDF documents, confirmed actively exploited (CISA KEV) in December 2011. Affects Windows, Mac OS X, and UNIX platforms across multiple product versions. CVSS 10.0 with network vector and no authentication required, combined with 18.73% EPSS score (95th percentile) and confirmed exploitation, makes this a critical priority requiring immediate patching despite the vulnerability's age.
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote code execution, exploited as a zero-day in December 2011 through crafted PDF files.
Remote code execution in Microsoft Internet Explorer 6, 7, and 8 allows attackers to execute arbitrary code through use-after-free or uninitialized memory corruption in the HTML+TIME (Timed Interactive Multimedia Extensions) engine. With an EPSS score of 52.37% (98th percentile) and publicly available exploit code, this represents a high-probability exploitation risk despite requiring user interaction to visit a malicious webpage. Microsoft released patch MS11-050 in June 2011, and the vendor specifically noted that IE9 was not affected by this implementation flaw.
A stack-based buffer overflow in win32k.sys RtlQueryRegistryValues function allows local privilege escalation and UAC bypass on Windows XP through Windows 7 via crafted REG_BINARY registry values.
Remote code execution in Microsoft Office 2003-2010 and Office for Mac 2004-2011 allows attackers to execute arbitrary code via malicious RTF documents. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code and an EPSS score of 93.79% (100th percentile), indicating extremely high real-world exploitation likelihood. Microsoft released patches via security bulletin MS10-087. The vulnerability affects a wide range of Office versions across Windows and macOS platforms, representing significant enterprise exposure despite the 2010 disclosure date.
Microsoft Office Excel 2002 through 2007 and Office for Mac contain a memory corruption vulnerability triggered by a specially crafted spreadsheet with a malformed FEATHEADER record, allowing remote code execution.
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab object that allows remote attackers to execute arbitrary code via a crafted PDF argument.
A critical integer overflow vulnerability exists in GStreamer's gst-plugins-base package before version 0.10.23, allowing remote attackers to execute arbitrary code through specially crafted COVERART tags in Vorbis audio files. The vulnerability triggers when base64-encoded cover art data causes an integer overflow during memory allocation, leading to a heap buffer overflow with full code execution potential. With an EPSS score of 2.82% (86th percentile) and patches available since 2009, this represents a high-severity but dated vulnerability that may still affect legacy systems.
Alpine Linux: mbedtls fixed in 3.6.2-r0
lldpd on Alpine Linux was patched in package version 1.0.22-r0, addressing an unspecified vulnerability in the Link Layer Discovery Protocol daemon. The exact nature of the flaw - whether remote code execution, denial of service, information disclosure, or privilege escalation - is not disclosed in available data. CVSS score, vector, and CWE classification are all absent, meaning severity and exploitability cannot be quantified from current intelligence. No KEV listing or public exploit has been identified at time of analysis.
Alpine Linux: opensc fixed in 0.26.0-r0
Alpine Linux: opensc fixed in 0.26.0-r0
Alpine Linux: opensc fixed in 0.26.0-r0
ImageMagick on Alpine Linux has been patched in package version 7.1.2.24-r0, addressing an unspecified vulnerability. The nature, severity, and exploitability of the underlying flaw are not disclosed in available intelligence - no CVE description, CVSS score, or CWE classification has been published at time of analysis. Alpine Linux systems running ImageMagick prior to the 7.1.2.24-r0 package should be treated as potentially affected until further vendor clarification is available.
ImageMagick on Alpine Linux received a security fix in package version 7.1.2.24-r0. The specific vulnerability class, impact, and affected versions prior to the fix have not been disclosed in the available intelligence. Based solely on the Alpine Linux vendor advisory, this entry represents a patched security issue in ImageMagick, a widely-used image processing library - however, the nature of what an attacker could do, and under what conditions, cannot be characterized without additional CVE details.
Vim on Alpine Linux was patched in package version 9.2.0663-r0, addressing an unspecified vulnerability. The exact nature, impact, and attack vector of this vulnerability are not disclosed in the available intelligence - the CVE description contains only the fix version and no vulnerability details. No CVSS score, CWE classification, or narrative description is provided, making it impossible to characterize the vulnerability type, affected scope, or attacker capability from current data.
Out-of-bounds write in the jq command-line JSON processor (CWE-787) lets a crafted JSON input corrupt memory when parsed, threatening the integrity and availability of the processing host. Tracked upstream as GHSA-cfh2-vwfq-qfmm and packaged by Alpine Linux, the flaw requires a victim to run jq against attacker-controlled data (local vector, user interaction required). No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided.
Heap-based buffer overflow in socat's SOCKS5 reply parser allows a malicious or compromised SOCKS5 proxy server to corrupt heap memory in clients that route connections through it, with potential for code execution. The flaw affects socat versions prior to 1.8.1.2 (packaged on Alpine Linux as 1.8.1.2-r0) and is triggered when socat acts as a SOCKS5 client and processes an attacker-crafted server reply. No public exploit identified at time of analysis; the CVSS 4.0 base score is 9.2, but the High attack complexity (AC:H) reflects that exploitation depends on a specific SOCKS5 usage path.
Alpine Linux: mbedtls fixed in 3.6.1-r0
GStreamer gst-plugins-good on Alpine Linux received a security fix packaged as version 1.26.3-r0 in the Alpine repository. The underlying vulnerability details, affected functionality, and impact class are not disclosed in the available intelligence - only the vendor-reported fix version is confirmed. Security teams running Alpine Linux with gst-plugins-good should treat this as an uncharacterized security fix requiring urgent upgrade pending fuller disclosure.
radvd (Router Advertisement Daemon) on Alpine Linux was patched in package version 2.21-r0 to address an unspecified vulnerability tracked as CVE-2026-48715. The nature of the flaw - its root cause, exploitability, and potential impact - is not disclosed in the available intelligence. radvd handles IPv6 router advertisements and neighbor discovery, meaning vulnerabilities in this component can affect IPv6 network routing, neighbor discovery, or host configuration. No active exploitation, CVSS score, or proof-of-concept code has been identified at time of analysis.