CWE-121
AllowedStack-based Buffer Overflow
Abstraction: Variant · Status: Draft
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
5212 vulnerabilities reference this CWE, most recent first.
GHSA-QVQM-CCP5-GR98
Vulnerability from github – Published: 2026-06-08 15:32 – Updated: 2026-06-08 21:31Shenzhen Tenda Technology Co., Ltd Tenda AC1206 v15.03.06.23 was discovered to contain multiple stack overflows in the fromGstDhcpSetSer function via the username and password parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
{
"affected": [],
"aliases": [
"CVE-2026-36789"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-08T15:16:45Z",
"severity": "HIGH"
},
"details": "Shenzhen Tenda Technology Co., Ltd Tenda AC1206 v15.03.06.23 was discovered to contain multiple stack overflows in the fromGstDhcpSetSer function via the username and password parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.",
"id": "GHSA-qvqm-ccp5-gr98",
"modified": "2026-06-08T21:31:49Z",
"published": "2026-06-08T15:32:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-36789"
},
{
"type": "WEB",
"url": "https://github.com/xhh0124/SemVulLLM/tree/main/AC1206/fromGstDhcpSetSer"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QVR7-W9FR-343X
Vulnerability from github – Published: 2022-02-19 00:01 – Updated: 2022-03-01 00:00This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15510.
{
"affected": [],
"aliases": [
"CVE-2021-46638"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-18T20:15:00Z",
"severity": "HIGH"
},
"details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15510.",
"id": "GHSA-qvr7-w9fr-343x",
"modified": "2022-03-01T00:00:56Z",
"published": "2022-02-19T00:01:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46638"
},
{
"type": "WEB",
"url": "https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-225"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-QVWW-5M45-9X54
Vulnerability from github – Published: 2025-04-17 18:31 – Updated: 2025-04-18 15:31Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanMTU2.
{
"affected": [],
"aliases": [
"CVE-2025-25455"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-17T18:15:48Z",
"severity": "HIGH"
},
"details": "Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanMTU2.",
"id": "GHSA-qvww-5m45-9x54",
"modified": "2025-04-18T15:31:37Z",
"published": "2025-04-17T18:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25455"
},
{
"type": "WEB",
"url": "https://gist.github.com/xyqer1/6c865a9ec44b4797e78b6765cd5c84e5"
},
{
"type": "WEB",
"url": "https://github.com/xyqer1/Tenda-AC10-AdvSetMacMtuWan-wanMTU2-StackOverflow"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QVXG-WJXC-R4GG
Vulnerability from github – Published: 2023-06-07 16:11 – Updated: 2023-06-07 16:11Vapor is an HTTP web framework for Swift. Vapor versions earlier than 4.61.1 are vulnerable to a denial of service in the URLEncodedFormDecoder.
Impact
When using automatic content decoding, e.g.
app.post("foo") { request -> String in
let foo = try request.content.decode(Foo.self)
return "\(foo)"
}
An attacker can craft a request body that can make the server crash with the following request:
curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo
The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow.
Patches
Fixed in 4.61.1
Workarounds
If you don't need to decode Form URL Encoded data, you can disable the ContentConfiguration so it won't be used. E.g. in configure.swift
var contentConfig = ContentConfiguration()
contentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .json)
contentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .json)
contentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .jsonAPI)
contentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .jsonAPI)
ContentConfiguration.global = contentConfig
For more information
If you have any questions or comments about this advisory: * Open an issue in the Vapor repo * Ask in Vapor Discord
{
"affected": [
{
"package": {
"ecosystem": "SwiftURL",
"name": "github.com/vapor/vapor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.61.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31019"
],
"database_specific": {
"cwe_ids": [
"CWE-120",
"CWE-121",
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-07T16:11:16Z",
"nvd_published_at": "2022-06-09T13:15:00Z",
"severity": "HIGH"
},
"details": "Vapor is an HTTP web framework for Swift. Vapor versions earlier than 4.61.1 are vulnerable to a denial of service in the URLEncodedFormDecoder.\n\n### Impact\nWhen using automatic content decoding, e.g. \n\n```swift\napp.post(\"foo\") { request -\u003e String in\n let foo = try request.content.decode(Foo.self)\n return \"\\(foo)\"\n}\n```\n\nAn attacker can craft a request body that can make the server crash with the following request:\n\n```\ncurl -d \"array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n \u0027[_0][0][array]\u0027; done)[string][_0]=hello%20world\" http://localhost:8080/foo\n```\n\nThe issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow.\n\n### Patches\nFixed in 4.61.1\n\n### Workarounds\nIf you don\u0027t need to decode Form URL Encoded data, you can disable the `ContentConfiguration` so it won\u0027t be used. E.g. in **configure.swift**\n\n```swift\nvar contentConfig = ContentConfiguration()\ncontentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .json)\ncontentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .json)\ncontentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .jsonAPI)\ncontentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .jsonAPI)\nContentConfiguration.global = contentConfig\n```\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the Vapor repo](https://github.com/vapor/vapor)\n* Ask in [Vapor Discord](http://vapor.team)",
"id": "GHSA-qvxg-wjxc-r4gg",
"modified": "2023-06-07T16:11:16Z",
"published": "2023-06-07T16:11:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vapor/vapor/security/advisories/GHSA-qvxg-wjxc-r4gg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31019"
},
{
"type": "WEB",
"url": "https://github.com/vapor/vapor/commit/6c63226a4ab82ce53730eb1afb9ca63866fcf033"
},
{
"type": "PACKAGE",
"url": "https://github.com/vapor/vapor"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Vapor vulnerable to denial of service in URLEncodedFormDecoder"
}
GHSA-QW52-QV79-54WV
Vulnerability from github – Published: 2023-01-12 00:30 – Updated: 2023-01-23 18:30Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd s_schd, at 0x9d01a010, the value for the grp key is copied using strcpy to the buffer at $sp+0x280.This buffer is 16 bytes large, sending anything longer will cause a buffer overflow.
{
"affected": [],
"aliases": [
"CVE-2017-16293"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-11T22:15:00Z",
"severity": "HIGH"
},
"details": "Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the \"cc\" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd s_schd, at 0x9d01a010, the value for the `grp` key is copied using `strcpy` to the buffer at `$sp+0x280`.This buffer is 16 bytes large, sending anything longer will cause a buffer overflow.",
"id": "GHSA-qw52-qv79-54wv",
"modified": "2023-01-23T18:30:19Z",
"published": "2023-01-12T00:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16293"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2017-0483"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QW5G-QCCP-WCHW
Vulnerability from github – Published: 2024-03-28 15:30 – Updated: 2024-08-16 21:32Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function.
{
"affected": [],
"aliases": [
"CVE-2024-30586"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-28T14:15:15Z",
"severity": "MODERATE"
},
"details": "Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function.",
"id": "GHSA-qw5g-qccp-wchw",
"modified": "2024-08-16T21:32:35Z",
"published": "2024-03-28T15:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30586"
},
{
"type": "WEB",
"url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formWifiBasicSet_security_5g.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QW7V-5RG2-WRWR
Vulnerability from github – Published: 2024-09-10 12:30 – Updated: 2024-09-10 12:30A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0015), Tecnomatix Plant Simulation V2404 (All versions < V2404.0004). The affected applications contain a stack based overflow vulnerability while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
{
"affected": [],
"aliases": [
"CVE-2024-41170"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-10T10:15:11Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions \u003c V2302.0015), Tecnomatix Plant Simulation V2404 (All versions \u003c V2404.0004). The affected applications contain a stack based overflow vulnerability while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.",
"id": "GHSA-qw7v-5rg2-wrwr",
"modified": "2024-09-10T12:30:38Z",
"published": "2024-09-10T12:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41170"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-427715.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-QW8Q-54X9-GJWH
Vulnerability from github – Published: 2024-01-26 15:30 – Updated: 2024-01-26 15:30A vulnerability was found in Tenda AC10U 15.03.06.49_multi_TDE01 and classified as critical. This issue affects the function formWifiWpsOOB. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252131. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2024-0926"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-26T15:15:08Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Tenda AC10U 15.03.06.49_multi_TDE01 and classified as critical. This issue affects the function formWifiWpsOOB. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252131. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-qw8q-54x9-gjwh",
"modified": "2024-01-26T15:30:30Z",
"published": "2024-01-26T15:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0926"
},
{
"type": "WEB",
"url": "https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/formWifiWpsOOB.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.252131"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.252131"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-QW9Q-7F95-XH3Q
Vulnerability from github – Published: 2023-09-21 15:30 – Updated: 2024-04-04 07:47D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter macCloneMac in setMAC.
{
"affected": [],
"aliases": [
"CVE-2023-43237"
],
"database_specific": {
"cwe_ids": [
"CWE-121",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-21T13:15:10Z",
"severity": "CRITICAL"
},
"details": "D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter macCloneMac in setMAC.",
"id": "GHSA-qw9q-7f95-xh3q",
"modified": "2024-04-04T07:47:28Z",
"published": "2023-09-21T15:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43237"
},
{
"type": "WEB",
"url": "https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/setMAC/1.md"
},
{
"type": "WEB",
"url": "https://www.dlink.com/en/security-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QWCG-C534-7PW3
Vulnerability from github – Published: 2026-01-28 18:30 – Updated: 2026-01-28 18:3010-Strike Network Inventory Explorer 8.65 contains a buffer overflow vulnerability in exception handling that allows remote attackers to execute arbitrary code. Attackers can craft a malicious file with 209 bytes of padding and a specially constructed Structured Exception Handler to trigger code execution.
{
"affected": [],
"aliases": [
"CVE-2020-36961"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-28T18:16:46Z",
"severity": "HIGH"
},
"details": "10-Strike Network Inventory Explorer 8.65 contains a buffer overflow vulnerability in exception handling that allows remote attackers to execute arbitrary code. Attackers can craft a malicious file with 209 bytes of padding and a specially constructed Structured Exception Handler to trigger code execution.",
"id": "GHSA-qwcg-c534-7pw3",
"modified": "2026-01-28T18:30:48Z",
"published": "2026-01-28T18:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36961"
},
{
"type": "WEB",
"url": "https://www.10-strike.com"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/49134"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/strike-network-inventory-explorer-buffer-overflow-seh"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation MIT-10
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Implement and perform bounds checking on input.
Mitigation
Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
Mitigation MIT-11
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
No CAPEC attack patterns related to this CWE.