A buffer overflow is a memory-safety bug in which a program writes more data into a memory buffer than it can hold, overwriting adjacent memory.
How a buffer overflow works
Programs written in C and C++ reserve fixed-size buffers for data such as strings or network packets. If the code copies input without checking its length – with functions like strcpy or sprintf – the extra bytes spill over into neighbouring memory. In a stack-based overflow they can overwrite the function’s return address; in a heap-based overflow they corrupt other objects and allocator metadata.
An attacker who controls the overflowing data can redirect execution to their own code or reuse existing code fragments (return-oriented programming). The result is often remote code execution or privilege escalation; at minimum the program crashes.
Why buffer overflows matter
Buffer overflows are among the oldest and most exploited classes of vulnerabilities. The Morris worm used one in 1988, and Code Red (2001) and SQL Slammer (2003) spread worldwide through overflows in Microsoft servers. Out-of-bounds write (CWE-787) still ranks near the top of the CWE Top 25 most dangerous software weaknesses. Together with use-after-free, memory-safety bugs account for the majority of critical vulnerabilities in large C/C++ code bases, according to Microsoft and Google.
How to prevent buffer overflows
- Use memory-safe languages such as Rust, Go, Java or C# for new code, as recommended by CISA and NSA.
- In C/C++, use bounds-checked functions and modern containers, and test with fuzzers and AddressSanitizer.
- Keep compiler and OS mitigations enabled: stack canaries, DEP/NX, ASLR and control-flow integrity.
- Patch promptly – public exploits for overflows appear quickly.
