Cyber Resilience

CWE · MITRE source

CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer

Abstraction: Class · CVEs in our corpus: 14,169

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Last updated: 22 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 12 mapping(s) from 1 framework(s): CAPEC 12 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SI-16 Memory Protection
  • SI-4 System Monitoring
  • SA-11 Developer Testing and Evaluation
  • SC-27 Platform-independent Applications
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V17.3.2

NIST 800-53 r5 controls that address this weakness (4)AI-assisted

Control Title Family Why it addresses this CWE
SI-16Memory ProtectionSIMemory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.
SI-4System MonitoringSIDetects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.
SA-11Developer Testing and EvaluationSAOngoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.
SC-27Platform-independent ApplicationsSCManaged runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2020-0796 KEV 10.010.00.99812020-03-12
CVE-2008-4250 KEV 9.99.80.98752008-10-23
CVE-2010-3765 KEV 9.99.80.83282010-10-28
CVE-2011-1889 KEV 9.99.80.48372011-06-16
CVE-2016-1287 9.99.80.76982016-02-11
CVE-2016-2108 9.99.80.77912016-05-05
CVE-2014-3931 KEV 9.99.80.28982017-03-31
CVE-2017-12240 KEV 9.99.80.13882017-09-29
CVE-2017-14492 9.99.80.93312017-10-03
CVE-2017-14493 9.99.80.83642017-10-03
CVE-2017-15944 KEV 9.99.80.98302017-12-11
CVE-2017-13696 9.99.80.78312018-01-24
CVE-2018-6892 9.99.80.93392018-02-11
CVE-2018-7584 9.99.80.87352018-03-01
CVE-2018-7445 KEV 9.99.80.61022018-03-19
CVE-2018-0151 KEV 9.99.80.14292018-03-28
CVE-2018-9059 9.99.80.77322018-04-20
CVE-2016-6563 9.99.80.79952018-07-13
CVE-2019-1663 9.99.80.95712019-02-28
CVE-2020-29557 KEV 9.99.80.54322021-01-29
CVE-2021-22991 KEV 9.99.80.61062021-03-31
CVE-2025-31200 KEV 9.99.80.19662025-04-16
CVE-2025-6543 KEV 9.99.80.10092025-06-25
CVE-2025-7775 KEV 9.99.80.19632025-08-26
CVE-2018-7573 9.89.80.69202018-03-01