In simple terms
Software sets aside small blocks of memory, called buffers, to hold the data it is working on. A buffer overflow happens when more data arrives than the block can take.
The extra data does not vanish. It spills into neighboring memory and overwrites whatever was already there.
How it works
CISA describes these flaws as arising when threat actors access or write information in the wrong part of a computer’s memory, outside the memory buffer. The general classification is CWE-119, with stack based overflows as CWE-121 and heap based overflows as CWE-122.
Some programming languages let a developer write past the end of a buffer without complaint. Languages that check those boundaries automatically are called memory safe, and CISA urges developers to use them.
An attacker who controls what spills over can sometimes overwrite the instruction that tells the program where to go next. That turns a simple crash into a way to run their own code.
NIST defines the attack as overloading a predefined amount of memory storage in a buffer, which can potentially overwrite and corrupt memory beyond the buffer’s boundaries.
Why it matters
The consequences run from data corruption and program crashes to exposed data and unauthorized code execution. CISA and the FBI warn that attackers use these flaws to gain their first foothold in a network.
The bug class is decades old and still common, which is why regulators now treat it as a design failure rather than bad luck.
Where you’ll see it
- Security advisories and vulnerability listings
- Urgent patch notices from software vendors
- Debates about moving old code to memory safe languages
- Breach reports describing how attackers got in
Example
A login form expects a name of up to 32 characters. Sent 5,000 characters instead, a vulnerable program writes all of them, overwriting memory it never meant to touch.
Often confused with
A buffer overflow is not a memory leak. A leak wastes memory that is never released. An overflow writes into memory that belongs to something else.
Key facts
- Buffer overflow vulnerabilities are classified as CWE-119, with stack based overflows as CWE-121 and heap based overflows as CWE-122.1
- CISA describes buffer overflows as arising when threat actors access or write information in the wrong part of a computer memory, outside the memory buffer.1
- Consequences include data corruption, sensitive data exposure, program crashes and unauthorized code execution.1
- NIST defines a buffer overflow attack as overloading a predefined amount of memory storage in a buffer, which can potentially overwrite and corrupt memory beyond the buffer boundaries.2
- CISA and the FBI issued a joint alert on 12 February 2025 urging software makers to eliminate this class of defect, including by using memory safe languages.3
Related concepts
Quick checkWhat makes a programming language memory safe?Show answer
It checks memory boundaries automatically, so code cannot silently write past the end of a buffer.
Sources
- Cybersecurity and Infrastructure Security Agency. Secure by Design Alert: Eliminating Buffer Overflow Vulnerabilities. Undated (accessed 22 September 2026)
- National Institute of Standards and Technology, Computer Security Resource Center. Buffer Overflow Attack, CSRC Glossary. Undated (accessed 22 September 2026)
- Cybersecurity and Infrastructure Security Agency. CISA and FBI Warn of Malicious Cyber Actors Using Buffer Overflow Vulnerabilities to Compromise Software. 12 February 2025 (accessed 22 September 2026)
Editorially reviewed by Specialty Digest Editorial TeamLast reviewed September 22, 2026Researched and drafted with AI assistanceReport an issue