Classic Buffer Overflow (CWE-120)
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
About CWE-120
MITRE lists these common consequences: Modify Memory, Execute Unauthorized Code or Commands, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), affecting integrity, confidentiality, availability.
Mitigations
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- Consider adhering to the following rules when allocating and managing an application's memory:
Detection
MITRE lists these detection methods: Automated Static Analysis (high), Automated Static Analysis - Binary or Bytecode (high), Automated Static Analysis - Source Code (high), Architecture or Design Review (high), Automated Dynamic Analysis (moderate).
Related Attack Patterns
10 of 13 CAPEC patternsCAPEC-100Overflow BuffersStandard · Severity Very High · Likelihood High
Loading…
CAPEC-44Overflow Binary Resource FileDetailed · Severity Very High · Likelihood High
Loading…
CAPEC-67String Format Overflow in syslog()Detailed · Severity Very High · Likelihood High
Loading…
CAPEC-8Buffer Overflow in an API CallDetailed · Severity High · Likelihood High
Loading…
CAPEC-9Buffer Overflow in Local Command-Line UtilitiesDetailed · Severity High · Likelihood High
Loading…
CAPEC-10Buffer Overflow via Environment VariablesDetailed · Severity High · Likelihood High
Loading…
CAPEC-14Client-side Injection-induced Buffer OverflowDetailed · Severity High · Likelihood Medium
Loading…
CAPEC-24Filter Failure through Buffer OverflowDetailed · Severity High · Likelihood High
Loading…
CAPEC-42MIME ConversionDetailed · Severity High · Likelihood High
Loading…
CAPEC-45Buffer Overflow via Symbolic LinksDetailed · Severity High · Likelihood High
Loading…
Showing the 10 most general patterns. All 13 related attack patterns on cwe.mitre.org →
CWE-120 in the KEV Catalog
as of October 28, 2026- 4 CISA KEV entries name Classic Buffer Overflow (CWE-120) in their CVE record, tied for 35th among the 132 weaknesses named in the catalog.
- Zyxel has the most CWE-120 entries in the CISA KEV catalog (2), followed by PHP (1) and SonicWall (1).
CWE-120 Vulnerabilities
6 CVEs| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2023-33010KEV Zyxel Multiple Firewalls Buffer Overflow Vulnerability | Zyxel Multiple Firewalls Buffer Overflow Vulnerability | Zyxel | 9.8 | 29.0% | KEV | 2023-05-24 |
| CVE-2023-33009KEV Zyxel Multiple Firewalls Buffer Overflow Vulnerability | Zyxel Multiple Firewalls Buffer Overflow Vulnerability | Zyxel | 9.8 | 28.1% | KEV | 2023-05-24 |
| CVE-2019-11043KEV Underflow in PHP-FPM can lead to RCE | Underflow in PHP-FPM can lead to RCE | PHP | 8.7 | 99.7% | KEV | 2019-10-28 |
| CVE-2020-5135KEV SonicWall SonicOS Buffer Overflow Vulnerability | SonicWall SonicOS Buffer Overflow Vulnerability | SonicWall | 9.8 | 26.9% | KEV | 2020-10-12 |
| CVE-2026-32746 | - | GNU | 9.8 | 44.1% | 2026-03-13 | |
| CVE-2026-7854 D-Link DI-8100 POST Parameter url_rule.asp url_rule_asp buffer overflow | D-Link DI-8100 POST Parameter url_rule.asp url_rule_asp buffer overflow | D-Link | 9.8 | 5.9% | 2026-05-05 |
Frequently Asked Questions
What is CWE-120?→
CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')) is a MITRE CWE entry. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
How many exploited vulnerabilities are classified as CWE-120?→
This database lists 6 CVE records mapped to CWE-120 by their CVE Numbering Authority. 4 of them are in the CISA Known Exploited Vulnerabilities catalog, and CISA links 2 to known ransomware campaigns. Examples include CVE-2023-33010, CVE-2023-33009, CVE-2019-11043.
Weakness description, consequences, and mitigations from the CWE List, © The MITRE Corporation, used under the CWE Terms of Use. CWE mappings come from each CVE record's CNA. Exploited-in-the-wild data from the CISA KEV catalog (CC0). This site is not endorsed or certified by MITRE or CISA. Attack patterns from CAPEC 3.9, © The MITRE Corporation, used under the CAPEC Terms of Use.