CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Abstraction: Base · CVEs in our corpus: 4,371

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Last updated: 22 August 2026 20:22 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 11 mapping(s) from 1 framework(s): CAPEC 11 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

SC-27 Platform-independent Applications
ID.RA-01
PR.PS-02
PR.PS-06

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V5.2.1

NIST 800-53 r5 controls that address this weakness (1)AI-assisted

Control	Title	Family	Why it addresses this CWE
`SC-27`	Platform-independent Applications	SC	Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2016-10174` KEV	9.9	9.8	0.8345	2017-01-30
`CVE-2017-7269` KEV	9.9	9.8	0.9982	2017-03-27
`CVE-2017-6862` KEV	9.9	9.8	0.4270	2017-05-26
`CVE-2018-6789` KEV	9.9	9.8	0.8172	2018-02-08
`CVE-2019-12255`	9.9	9.8	0.7525	2019-08-09
`CVE-2020-8012`	9.9	9.8	0.7742	2020-02-18
`CVE-2020-10188`	9.9	9.8	0.7434	2020-03-06
`CVE-2020-15069` KEV	9.9	9.8	0.1067	2020-06-29
`CVE-2020-11984`	9.9	9.8	0.9004	2020-08-07
`CVE-2020-5135` KEV	9.9	9.8	0.2456	2020-10-12
`CVE-2021-3711`	9.9	9.8	0.8782	2021-08-24
`CVE-2022-37055` KEV	9.9	9.8	0.5553	2022-08-28
`CVE-2023-33009` KEV	9.9	9.8	0.2814	2023-05-24
`CVE-2023-33010` KEV	9.9	9.8	0.2881	2023-05-24
`CVE-2019-16724`	9.8	9.8	0.7216	2019-09-24
`CVE-2021-22992`	9.8	9.8	0.7271	2021-03-31
`CVE-2023-25076`	9.7	9.8	0.6575	2023-03-30
`CVE-2017-15222`	9.6	9.8	0.6033	2017-10-24
`CVE-2023-28502`	9.6	9.8	0.6110	2023-03-29
`CVE-2025-20333` KEV	9.6	9.9	0.4039	2025-09-25
`CVE-2020-24336`	9.5	9.8	0.5869	2020-12-11
`CVE-2019-12518`	9.4	9.8	0.5074	2019-12-02
`CVE-2020-15999` KEV	9.4	9.6	0.4430	2020-11-03
`CVE-2019-17181`	9.3	9.8	0.4870	2019-10-28
`CVE-2006-2492` KEV	9.2	8.8	0.4839	2006-05-20