VYPR

CWE-562

Return of Stack Variable Address

BaseDraft

Description

A function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash.

Because local variables are allocated on the stack, when a program returns a pointer to a local variable, it is returning a stack address. A subsequent function call is likely to re-use this same stack address, thereby overwriting the value of the pointer, which no longer corresponds to the same variable since a function's stack frame is invalidated when it returns. At best this will cause the value of the pointer to change unexpectedly. In many cases it causes the program to crash the next time the pointer is dereferenced.

Hierarchy (View 1000)

Parents

Children

none

CVEs mapped to this weakness (8)

  • CVE-2022-41837CriDec 22, 2022
    OpenImageIO
    Openimageio
    risk 0.64cvss 9.8epss 0.02

    An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially-crafted exif metadata can lead to stack-based memory corruption. An attacker can provide a malicious file to trigger this…

  • CVE-2024-33045HigSep 2, 2024
    Qualcomm
    ADSP
    risk 0.55cvss 8.4epss 0.00

    Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

  • CVE-2021-21798HigSep 15, 2021
    Nitro Pro PDF
    Nitro Pro PDF
    risk 0.52cvss 7.8epss 0.16

    An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a stack variable to go out of scope, resulting in the application dereferencing a stale pointer. This can lead to code…

  • CVE-2024-4418MedMay 8, 2024
    Libvirt
    Libvirt
    risk 0.40cvss 6.2epss 0.00

    A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback…

  • CVE-2020-21686MedAug 22, 2023
    Nasm
    NASM
    risk 0.36cvss 5.5epss 0.00

    A stack-use-after-scope issue discovered in expand_mmac_params function in preproc.c in nasm before 2.15.04 allows remote attackers to cause a denial of service via crafted asm file.

  • CVE-2026-3591MedMar 25, 2026
    Isc
    Bind
    risk 0.35cvss 5.4epss 0.00

    A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP…

  • CVE-2026-26399MedApr 20, 2026
    Arduino
    Arduino_Core_STM32
    risk 0.34cvss 5.3epss 0.00

    A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function allocates a TIM_HandleTypeDef structure on the stack and passes its address to HAL initialization routines, where it is stored in a global timer handle…

  • CVE-2026-34553MedMar 31, 2026
    Color (software)
    Iccdev
    risk 0.19cvss 4.0epss 0.00

    iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a defect in LUT dump/iteration logic affecting CIccCLUT::Iterate() and output produced by CIccMBB::Describe() (via CLUT dumping). This issue has been…