# What is a Buffer Overflow?

> A buffer overflow is a memory-safety weakness in which software writes more data to a memory buffer than its allocated bounds can hold, causing adjacent memory or control data to be overwritten.

- Canonical URL: https://yellowcube.eu/glossary/buffer-overflow/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It often arises from missing or incorrect length checks in languages that allow direct memory access. Outcomes range from corrupted data and crashes to, in some conditions, unauthorized code execution.

Buffers may reside on the stack, heap, or other memory regions, and the weakness can involve an unsafe copy, an incorrect size calculation, or an out-of-bounds write. The overwritten location, attacker control, platform, and runtime protections shape exploitability and consequences.

### Key points

- **Root-cause reduction:** Prefer memory-safe languages and interfaces where feasible, validate lengths and integer calculations, avoid unbounded operations, and review interactions with native or otherwise memory-unsafe components.
- **Verification:** Use focused code review, static analysis, compiler diagnostics, sanitizers, fuzzing, and regression tests to find defects and confirm that corrections cover the underlying class.
- **Runtime layers:** Compiler and operating-system protections such as canaries, non-executable memory, and address randomization can make some exploitation harder, while isolation and least privilege can constrain consequences.
- **Important limitation:** A buffer overflow does not automatically permit code execution; it may only corrupt data or terminate a process. Runtime mitigations are defense in depth, not substitutes for removing the defective memory operation.

### Related terms

[Vulnerability](<https://yellowcube.eu/glossary/vulnerability/>) · [Exploit](<https://yellowcube.eu/glossary/exploit/>) · [Remote code execution (RCE)](<https://yellowcube.eu/glossary/remote-code-execution/>) · [Static application security testing (SAST)](<https://yellowcube.eu/glossary/static-application-security-testing/>) · [Software supply-chain security](<https://yellowcube.eu/glossary/software-supply-chain-security/>)

### Sources

[CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')](https://cwe.mitre.org/data/definitions/120.html) · [CWE-787: Out-of-bounds Write](https://cwe.mitre.org/data/definitions/787.html) · [CISA and FBI: Eliminating Buffer Overflow Vulnerabilities](https://www.cisa.gov/sites/default/files/2025-02/secure-by-design-alert-eliminating-buffer-overflow-vulnerabilities-508c.pdf)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.