CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Description:
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected languages: Memory-Unsafe, C, C++, Assembly
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-118, CWE-20

Consequences:
  - Integrity: Execute Unauthorized Code or Commands
  - Availability: Read Memory
  - Confidentiality: Read Memory

Detection methods:
  - Automated Static Analysis: This weakness can often be detected using automated static analysis tools. Many modern tools use data flow analysis or constraint-based techniques to minimize the number of false positives. 
         
  - Automated Dynamic Analysis: This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, a
  - Automated Dynamic Analysis: Use tools that are integrated during
	     compilation to insert runtime error-checking mechanisms
	     related to memory safety errors, such as AddressSanitizer
	     (ASan) for C/C++ [REF-1518].
  - Automated Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             

Mitigations:
  - [Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. 
                   For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada
  - [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. 
                   Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. Thes
  - [Operation] Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detectio
  - [Implementation] Consider adhering to the following rules when allocating and managing an application's memory: 
                      
                         Double check that the buffer is as large as specified. 
                         When using functions that accept a number of bytes to copy, such as strncpy

Demonstrative examples:
This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.
This function allocates a buffer of 64 bytes to store the hostname, however there is no guarantee that the hostname will not be larger than 64 bytes. If an attacker specifies an address which resolves to a very large hostname, then the function may overwrite sensitive data or even relinquish control flow to the attacker.
void host_lookup(char *user_supplied_addr){ 
                         struct hostent *hp; in_addr_t *addr; char hostname[64]; in_addr_t inet_addr(const char *cp); 
                            
                            /*routine that ensures user_supplied_addr is in the right format for conversion */ 
                            
     

This example applies an encoding procedure to an input string and stores it into a buffer.
The programmer attempts to encode the ampersand character in the user-controlled string, however the length of the string is validated before the encoding procedure is applied. Furthermore, the programmer assumes encoding expansion will only expand a given character by a factor of 4, while the encoding of the ampersand expands by 5. As a result, when the encoding procedure expands the string it is possible to overflow the destination buffer if the attacker provides a string of many ampersands.
char * copy_input(char *user_supplied_string){ 
                         int i, dst_index; char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE); if ( MAX_SIZE <= strlen(user_supplied_string) ){ die("user st

Real-world examples:
  - CVE-2021-22991: Incorrect URI normalization in application traffic product leads to buffer overflow, as exploited in the wild per CISA KEV.
  - CVE-2025-47153: Chain: build process for JavaScript runtime environment can have inconsistent sizes for off_t (CWE-1102), allowing out-of-bounds access / segmentation fault (CWE-119)
  - CVE-2020-29557: Buffer overflow in Wi-Fi router web interface, as exploited in the wild per CISA KEV.
  - CVE-2009-2550: Classic stack-based buffer overflow in media player using a long entry in a playlist
  - CVE-2009-2403: Heap-based buffer overflow in media player using a long entry in a playlist