Buffer Overflow
A buffer overflow is a memory-safety vulnerability where a program writes more data into a fixed-size buffer than it can hold, overwriting adjacent memory and potentially corrupting data, crashing the application, or letting an attacker execute arbitrary code.
A buffer overflow happens when a program writes past the bounds of an allocated buffer — for example copying a long input into a fixed-size array without checking its length. The extra bytes spill into neighboring memory, overwriting other variables, pointers, or control data. In stack-based overflows this can clobber the saved return address; in heap-based overflows it can corrupt allocator metadata or adjacent objects. Both undermine the program's memory integrity.
Historically, buffer overflows are the archetypal memory-corruption exploit: by overwriting a return address or function pointer with an attacker-chosen value, an attacker can redirect execution to injected shellcode or, defeating non-executable memory, to existing code via return-oriented programming. This is why the class remains one of the most impactful in native software, cataloged as CWE-120 (classic buffer overflow) and CWE-787 (out-of-bounds write).
Buffer overflows arise almost exclusively in languages without automatic bounds checking, such as C and C++. Defenses include bounds-checked functions and length validation, compiler and OS mitigations (stack canaries, ASLR, non-executable stacks, and fortify checks), fuzzing and memory sanitizers, and — most durably — using memory-safe languages that check array bounds at runtime or compile time. For developers, careful handling of every buffer size and input length is essential in native code paths.