Cyber Resilience

CWE · MITRE source

CWE-121Stack-based Buffer Overflow

Abstraction: Variant · CVEs in our corpus: 3,440

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Last updated: 04 July 2026 00:28 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 7 mapping(s) from 3 framework(s): ATT&CK 5 (partial) · STIG oracle linux 8 1 (partial) · STIG oracle linux 9 1 (partial)

See the full cumulative-coverage rollup →

NIST 800-53 r5 controls that address this weakness (0)AI

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial).

T1068 Exploitation for Privilege Escalation←P →MT1190 Exploit Public-Facing Application←P →MT1203 Exploitation for Client Execution←P →MT1210 Exploitation of Remote Services←P →MT1212 Exploitation for Credential Access←P →M

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2009-0927 KEV10.08.80.96602009-03-19
CVE-2008-0015 KEV10.08.80.76652009-07-07
CVE-2013-2597 KEV10.08.40.01522014-08-31
CVE-2014-9163 KEV10.07.80.20362014-12-10
CVE-2018-5002 KEV10.07.80.25352018-07-09
CVE-2020-5735 KEV10.08.80.35642020-04-08
CVE-2021-20038 KEV10.09.80.99912021-12-08
CVE-2022-20699 KEV10.010.00.72462022-02-10
CVE-2022-20700 KEV10.010.00.05662022-02-10
CVE-2022-20701 KEV10.010.00.09752022-02-10
CVE-2022-20703 KEV10.010.00.09202022-02-10
CVE-2022-20708 KEV10.010.00.14862022-02-10
CVE-2025-0282 KEV10.09.00.99972025-01-08
CVE-2025-22457 KEV10.09.00.99972025-04-03
CVE-2025-42599 KEV UPD10.09.80.03022025-04-18
CVE-2025-32756 KEV UPD10.09.80.31422025-05-13
CVE-2025-20352 KEV10.07.70.37612025-09-24
CVE-2025-53521 KEV10.09.80.02252025-10-15
CVE-2014-07838.00.00.68362014-03-14
CVE-2014-07828.00.00.56842014-05-16
CVE-2014-23648.00.00.61382014-07-19
CVE-2017-130898.08.80.79852017-10-27
CVE-2018-11618.09.80.67222018-02-08
CVE-2018-105948.09.80.68962018-06-26
CVE-2016-65638.09.80.79952018-07-13