Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →A buffer overflow bug happens when software reads or writes beyond the memory set aside for a buffer. Depending on what memory is affected and whether an attacker can influence the input, the result may be a crash, exposed or corrupted data, or—in some circumstances—unauthorized code execution. Not every overflow is exploitable.
What a buffer overflow means
A buffer is a region of memory intended to hold a particular amount of data. A buffer overflow, also called a buffer overrun, occurs when software accesses memory outside that region. This article uses the term broadly for out-of-bounds reads and writes; some audiences use “buffer overflow” more narrowly for writes past the end.
As an Amazon Associate I earn from qualifying purchases.
NIST’s glossary defines a buffer overflow as a condition in which more input is placed in a buffer or data-holding area than its allocated capacity, overwriting other information. Its entry cites CNSSI 4009-2022 and NIST SP 800-28 Version 2. NIST glossary: buffer overflow
How the bug happens
The usual underlying mistake is mishandling a size or length. For example, code may copy externally supplied data into a fixed-size destination without checking that the data fits. The operation can also involve appending, decoding, or transforming data: a check on the original input is not enough if the output grows beyond the destination’s capacity.
#1 Best Overall
In C examples, MITRE illustrates both a 256-byte local array and a 256-byte heap allocation receiving unchecked input through strcpy. If the input is too large, the copy can run beyond the intended buffer boundary. A string’s terminating null character also takes space, so it must fit alongside the content. MITRE CWE-121: stack-based buffer overflow and MITRE CWE-122: heap-based buffer overflow
Transformation creates a less obvious version of the same problem. MITRE describes an encoding routine that assumes output will fit, even though the encoded representation can expand. Repeated ampersands, for example, can produce output larger than the input. Capacity checks should therefore account for the final representation, not just the incoming byte or character count. MITRE CWE-122
Stack and heap buffer overflows
“Stack” and “heap” identify where the affected buffer is allocated. They help describe the bug’s location, but neither label alone determines its severity or exploitability.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Type | Where the buffer is allocated | What the label tells you |
|---|---|---|
| Stack-based buffer overflow | On the call stack, often as a local variable | The out-of-bounds access affects a stack-allocated buffer. MITRE CWE-121 |
| Heap-based buffer overflow | In dynamically allocated memory | The out-of-bounds access affects a heap-allocated buffer. MITRE CWE-122 |
Use “stack-based buffer overflow” when you mean this memory-safety bug. “Stack overflow” can also mean stack exhaustion, commonly caused by excessive recursion, which is a different problem. MITRE CWE-121
What damage can a buffer overflow cause?
The outcome depends on the particular program, whether an attacker can reach the faulty operation and control its input, what memory is adjacent to the buffer, and which protections are active. Possible effects include:
- A crash or denial of service: an invalid access or corrupted state can stop the program from working.
- Data corruption: an out-of-bounds write can alter other information in memory.
- Information exposure: an out-of-bounds read may reveal data the program should not disclose.
- Unauthorized code execution or security-critical data changes: these are possible in some circumstances, not an automatic consequence of every overflow.
MITRE describes out-of-bounds buffer operations as a memory-safety weakness with potentially varied effects. MITRE CWE-119: improper restriction of operations within the bounds of a memory buffer NIST likewise notes that an overflow can overwrite other information. NIST glossary: buffer overflow
In a February 12, 2025 alert, CISA and the FBI characterized buffer overflow vulnerabilities as a well-understood subset of memory-safety vulnerabilities and urged software manufacturers to use proven prevention methods. The alert identifies data corruption, exposure of sensitive information, crashes, and unauthorized code execution as possible consequences. CISA and FBI: Secure by Design Alert on Eliminating Buffer Overflow Vulnerabilities (PDF)
How developers can reduce the risk
Prevention is stronger than relying on a protection that detects or limits damage after an unsafe access occurs. Useful practices include:
Quick Recap
Best Value
- Use bounds-aware language features or languages where feasible. Review native-code interfaces and unsafe escape hatches, because those can reintroduce memory risks. MITRE CWE-119
- Check capacity against the complete output. Include string terminators and any growth caused by encoding, escaping, or other transformations. MITRE CWE-121 and MITRE CWE-122
- Prefer vetted libraries and abstractions that enforce bounds. Safer string functions can help with string-handling errors, but they do not prevent every buffer overflow; many arise outside string operations. MITRE CWE-119
- Enable compiler protections and runtime hardening. Examples include stack canaries and range or index checks. These can detect or mitigate some errors, but they do not make unsafe code safe or eliminate the underlying defect. MITRE CWE-119 and MITRE CWE-122
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
