CWE · MITRE source
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
Last updated: 15 October 2026 20:36 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
Prevent
Stop it (NIST 800-53 / CSF Protect)
SC-27Platform-independent ApplicationsID.RA-01PR.PS-02PR.PS-06
Detect
Catch it (CSF Detect / Respond)
—
Harden
Shrink the surface (DISA STIG)
—
Validate
Prove the fix (OWASP ASVS)
V5.2.1
NIST 800-53 r5 controls PROPOSED for this weakness (1)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-27 | Platform-independent Applications | SC | Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2016-10174 KEV UPD | 9.9 | 9.8 | 0.8333 | 2017-01-30 |
CVE-2017-7269 KEV UPD | 9.9 | 9.8 | 0.9982 | 2017-03-27 |
CVE-2017-6862 KEV UPD | 9.9 | 9.8 | 0.4575 | 2017-05-26 |
CVE-2018-6789 KEV UPD | 9.9 | 9.8 | 0.8214 | 2018-02-08 |
CVE-2019-12255 UPD | 9.9 | 9.8 | 0.7508 | 2019-08-09 |
CVE-2020-8012 UPD | 9.9 | 9.8 | 0.7742 | 2020-02-18 |
CVE-2020-10188 UPD | 9.9 | 9.8 | 0.7434 | 2020-03-06 |
CVE-2020-15069 KEV UPD | 9.9 | 9.8 | 0.1067 | 2020-06-29 |
CVE-2020-11984 UPD | 9.9 | 9.8 | 0.9004 | 2020-08-07 |
CVE-2020-5135 KEV UPD | 9.9 | 9.8 | 0.2687 | 2020-10-12 |
CVE-2021-3711 UPD | 9.9 | 9.8 | 0.8782 | 2021-08-24 |
CVE-2022-37055 KEV UPD | 9.9 | 9.8 | 0.5553 | 2022-08-28 |
CVE-2023-33009 KEV UPD | 9.9 | 9.8 | 0.2814 | 2023-05-24 |
CVE-2023-33010 KEV UPD | 9.9 | 9.8 | 0.2902 | 2023-05-24 |
CVE-2019-16724 UPD | 9.8 | 9.8 | 0.7216 | 2019-09-24 |
CVE-2021-22992 UPD | 9.8 | 9.8 | 0.7271 | 2021-03-31 |
CVE-2023-25076 UPD | 9.7 | 9.8 | 0.6575 | 2023-03-30 |
CVE-2017-15222 UPD | 9.6 | 9.8 | 0.6033 | 2017-10-24 |
CVE-2020-24336 UPD | 9.6 | 9.8 | 0.5909 | 2020-12-11 |
CVE-2023-28502 UPD | 9.6 | 9.8 | 0.6110 | 2023-03-29 |
CVE-2025-20333 KEV UPD | 9.6 | 9.9 | 0.7121 | 2025-09-25 |
CVE-2019-12518 UPD | 9.4 | 9.8 | 0.5074 | 2019-12-02 |
CVE-2020-15999 KEV UPD | 9.4 | 9.6 | 0.6389 | 2020-11-03 |
CVE-2019-17181 UPD | 9.3 | 9.8 | 0.4769 | 2019-10-28 |
CVE-2006-2492 KEV UPD | 9.2 | 8.8 | 0.4811 | 2006-05-20 |