A Buffer Overflow is a software vulnerability that occurs when a program writes more data to a fixed-length memory buffer than it was designed to hold, overwriting adjacent memory.
When input exceeds the space allocated for it, the excess spills into neighboring memory. That can corrupt data, crash the program, or, in the worst case, let an attacker overwrite a control structure such as a function’s return address and redirect execution to their own code. It is one of the oldest and most studied vulnerability classes, especially common in languages like C and C++ that do not enforce array bounds automatically. A textbook example is a routine that copies user input into a 64-byte buffer without ever checking the length. Defenders counter it with input length validation, safer library functions, stack canaries, address space layout randomization, and non-executable memory. Worth stressing: these mitigations raise the cost of exploitation but do not remove the underlying flaw, so validating input and writing memory-safe code remain the real fix.
How is buffer overflow tested on the CISSP?
Buffer overflows fall under Domain 8, Software Development Security, which is 10% of the exam. Expect questions on the cause, the impact, and the layered defenses that reduce the risk.