Buffer overflow
buffer overrun · stack-based buffer overflow · heap overflow · memory corruption · CWE-120 · dépassement de tampon
A programming error in which software writes more data than a memory area can hold, overwriting neighbouring data, which can crash the program or let malicious code run.
In practice
This flaw mainly affects languages that leave memory management to the developer, such as C and C++, which are everywhere in operating systems, browsers and network equipment. Exploited skilfully, it leads to remote code execution; modern protections make exploitation harder but do not prevent it. CISA and the FBI call it an “unforgivable” defect and recommend writing new code in memory-safe languages such as Rust, Go, Java or C#.
In 1988, the Morris worm, one of the first internet worms, spread partly through a buffer overflow in the fingerd network service. In February 2025, CISA and the FBI were still citing six recently exploited flaws of this kind, including CVE-2025-0282 in Ivanti Connect Secure gateways.
How to protect yourself
- Write new code in a memory-safe language and plan the migration of the most exposed components.
- In C and C++: bounded copy functions, hardened compiler options, SAST analysis.
- Fuzz-test the components that process data from outside.
- Patch network equipment and exposed systems quickly.
