Cybersecurity glossary
What is an Out-of-Bounds Write?
Learn what an out-of-bounds write is, how writing outside object bounds corrupts memory and control flow, how OOB writes relate to buffer overflows, and how to prevent unsafe indexed stores.
Definition
An out-of-bounds write is a memory safety flaw in which a program writes data outside the valid boundaries of a buffer or object, corrupting adjacent memory such as other variables, object metadata, or control structures.
Why out-of-bounds writes matter
When software stores a value, it must store it inside an object that expects it. An out-of-bounds store silently edits a neighbor—maybe a length field, a freed-chunk header, or a function pointer.
Out-of-Bounds Write is therefore one of the most direct memory corruption primitives. Unlike a pure crash, a controlled OOB write can reshape program state until security boundaries collapse.
How OOB writes become exploits
Obtain an index or destination
Attacker input influences an array index, pointer offset, or copy length.
Bounds check fails open
Missing, inverted, or overflowed checks allow an invalid destination.
Write lands outside the object
Adjacent stack/heap memory receives attacker-controlled bytes.
Corruped state is used
Later logic trusts the overwritten length, flag, or pointer.
Escalate to control
Chained with leaks or allocator behavior to reach code execution goals.
Common OOB write patterns
Linear overflows
Classic buffer overflows that walk past the end of a destination array.
Wild index stores
array[user_index] = value without verifying index < length.
Off-by-one
Writing the terminator or last element one past the allocated end.
Wrapped size math
Integer overflow makes a check pass, then a large write corrupts the heap.
Prevention controls
| Control | Notes |
|---|---|
| Index checks | Require 0 <= i < len before every untrusted indexed write |
| Safe containers | Prefer vectors/slices that bounds-check in debug and secure builds |
| Checked size math | Detect overflow before allocation and before copy lengths |
| ASan in CI | Catches heap/stack OOB writes during fuzz and unit tests |
| Compiler hardening | Canaries, fortify, CFI raise cost of some control-flow outcomes |
| Memory-safe languages | Remove most OOB writes outside explicitly unsafe code |
- Find all indexed writes influenced by untrusted input.
- Add explicit bounds checks and regression tests for edges (0, len-1, len).
- Fuzz parsers with oversized indexes and lengths.
- Enable AddressSanitizer on native CI builds.
- Fix integer overflow on paths that compute write destinations.
- Sandbox components that must parse complex untrusted binaries.
- Prefer memory-safe rewrites for repeatedly buggy write sinks.
- Triage ASan heap-buffer-overflow on WRITE as security-critical.
The practical takeaway
An out-of-bounds write stores data outside a valid object and corrupts neighboring memory. Check every attacker-influenced index and length before writing.
If a write can touch memory you did not allocate for that object, assume an attacker will try to choose what sits next to it.
Related security terms
Out-of-Bounds Read
Reads past bounds leak data; writes past bounds corrupt state.
Buffer Overflow
A common form of OOB write caused by exceeding buffer capacity.
Heap Overflow
OOB writes into neighboring heap objects or allocator metadata.
Integer Overflow
Wrapped index or size math often authorizes OOB writes.
Frequently asked questions
What is an out-of-bounds write in simple terms?
The program writes to an index or address outside a valid object. Nearby memory is overwritten with attacker-influenced or unintended values.
Is every buffer overflow an OOB write?
Buffer overflows are a major subset of OOB writes. OOB writes also include negative index stores, off-by-one writes, and writes through corrupted pointers.
What can attackers achieve?
Depending on what is overwritten: crashes, altered security flags, forged object fields, function pointer hijacks, or full code execution.
How do indexes go out of bounds?
Missing checks, off-by-one errors, integer wrap in index math, trusting attacker lengths, or using a size from a different object.
Do canaries stop OOB writes?
Stack canaries may catch some linear stack overflows before return. They do not stop arbitrary index writes to unrelated objects or many heap cases.
How do you prevent OOB writes?
Bounds-check every index, use size-aware containers, enable ASan in testing, validate attacker lengths, and prefer memory-safe languages.
How is this different from an OOB read?
Reads disclose memory. Writes change memory. Writes more directly create corruption primitives; both are serious.
References
Explore authoritative guidance and frameworks related to out-of-bounds write.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.