Remote Code Execution, or short RCE/RCX

In computer security , arbitrary code execution ( ACE ) is an attacker's ability to run any commands or code of the attacker's choice on a target machine or in a target process . [ 1 ] An arbitrary code execution vulnerability is a security flaw in software or hardware allowing arbitrary code execution. A program that is designed to exploit such a vulnerability is called an arbitrary code execution exploit . The ability to trigger arbitrary code execution over a network (especially via a wide-area network such as the Internet) is often referred to as remote code execution ( RCE or RCX ).

There are a number of classes of vulnerability that can lead to an attacker's ability to execute arbitrary commands or code. For example:

Memory safety vulnerabilities such as buffer overflows or over-reads .

Deserialization vulnerabilities [ 2 ]

Type confusion vulnerabilities [ 3 ] [ 4 ]

GNU ldd arbitrary code execution [ 5 ]

Arbitrary code execution is commonly achieved through control over the instruction pointer (such as a jump or a branch ) of a running process . The instruction pointer points to the instruction in the process that will be executed. Control over the value of the instruction pointer therefore gives control over which instruction is executed . In order to execute arbitrary code, many exploits inject code into the process (for example by sending input to it which gets stored in an input buffer in RAM ) and use a vulnerability to change the instruction pointer to have it point to the injected code. The injected code will then automatically get executed. This type of attack exploits the fact that most computers (which use a Von Neumann architecture ) do not make a general distinction between code and data , [ 6 ] [ 7 ] so that malicious code can be camouflaged as harmless input data. Many newer CPUs have mechanisms to make this harder, such as a no-execute bit . [ 8 ] [ 9 ]

Combining with privilege escalation

On its own, an arbitrary code execution exploit will give the attacker the same privileges as the target process that is vulnerable. [ 10 ] For example, if exploiting a flaw in a web browser , an attacker could act as the user, performing actions such as modifying personal computer files or accessing banking information, but would not be able to perform system-level actions (unless the user in question also had that access).

To work around this, once an attacker can execute arbitrary code on a target, there is often an attempt at a privilege escalation exploit in order to gain additional control. This may involve the kernel itself or an account such as Administrator, SYSTEM, or root. With or without this enhanced control, exploits have the potential to do severe damage or turn the computer into a zombie —but privilege escalation helps with hiding the attack from the legitimate administrator of the system.

Retrogaming hobbyists have managed to find vulnerabilities in classic video games that allow them to execute arbitrary code, usually using a precise sequence of button inputs in a tool-assisted superplay to cause a buffer overflow , allowing them to write to protected memory . At Awesome Games Done Quick 2014, a group of speedrunners managed to code and run versions of the games Pong , Snake and Super Mario Bros. on a copy of Super Mario World [ 11 ] by utilizing an out-of-bounds read of a function pointer that points to a user controlled buffer to execute arbitrary code.

On May 1, 2018, a security researcher discovered an ACE vulnerability in the 7-Zip file archiver . [ 12 ]

On June 12, 2018, Bosnian security researcher Jean-Yves Avenard of Mozilla discovered an ACE vulnerability in Windows 10 . [ 13 ]

PHP has been the subject of numerous ACE vulnerabilities. [ 14 ] [ 15 ] [ 16 ]

On December 9, 2021, an RCE vulnerability called " Log4Shell " was discovered in popular logging framework Log4j , affecting many services including iCloud , Minecraft: Java Edition and Steam , and characterized as "the single biggest, most critical vulnerability of the last decade". [ 17 ] [ 18 ]

Follina (security vulnerability)

↑ n.a. (25 January 2021). "Remote code execution attack: what it is, how to protect your systems" . blog.kernelcare.com . Archived from the original on 2021-01-26 . Retrieved 2021-09-22 . [ self-published source? ]

↑ "Deserialization of untrusted data" . owasp.org .

↑ "Understanding type confusion vulnerabilities: CVE-2015-0336" . microsoft.com . 18 June 2015.

↑ "Exploiting CVE-2018-19134: remote code execution through type confusion in Ghostscript" . lgtm.com . 5 February 2019.

↑ "LDD arbitrary code execution" .

↑ Gilreath, William F.; Laplante, Phillip A. (2003). "Evolution of Instruction Sets". Computer Architecture: A Minimalist Perspective . pp. 23– 32. doi : 10.1007/978-1-4615-0237-1_4 . ISBN 978-1-4613-4980-8 .

↑ Reilly, Edwin D. (2003). Milestones in Computer Science and Information Technology . Greenwood Publishing Group. p. 245 . ISBN 9781573565219 .

↑ "Tech Insight: Execute Disable Bit (XD-Bit)" (PDF) . Toshiba Polska . 2005. Archived from the original (PDF) on 2018-10-31 . Retrieved 2018-10-31 .

↑ "AMD has you covered" (PDF) . AMD . 2012. Archived from the original (PDF) on Mar 5, 2019.

↑ Winterfeld, Steve (2013). "Offensive Tactics and Procedures". The Basics of Cyber Warfare . pp. 67– 82. doi : 10.1016/B978-0-12-404737-2.00005-7 . ISBN 978-0-12-404737-2 .

↑ Orland, Kyle (14 January 2014). "How an emulator-fueled robot reprogrammed Super Mario World on the fly" . Ars Technica . Retrieved 27 July 2016 .

↑ "A Vulnerability in 7-Zip Could Allow for Arbitrary Code Execution" . New York State Office of Information Technology Services . Archived from the original on 2021-08-15 . Retrieved 2018-10-31 .

↑ "Microsoft Windows CVE-2018-8213 Arbitrary Code Execution Vulnerability" . Symantec . Archived from the original on October 31, 2018 . Retrieved 2018-10-31 .

↑ "NVD - CVE-2017-12934" . nvd.nist.gov . Retrieved 2018-10-31 .

↑ "File Operation Induced Unserialization via the "phar://" Stream Wrapper" (PDF) . Secarma Labs . 2018.

↑ "NVD - CVE-2017-12933" . nvd.nist.gov . Retrieved 2018-10-31 .

↑ "Zeroday in ubiquitous Log4j tool poses a grave threat to the Internet" . Ars Technica . December 9, 2021 . Retrieved December 11, 2021 .

↑ "Recently uncovered software flaw 'most critical vulnerability of the last decade' " . The Guardian . 11 December 2021 . Retrieved December 11, 2021 .

Sommestad, Teodor; Holm, Hannes; Ekstedt, Mathias (June 2012). "Estimates of success rates of remote arbitrary code execution attacks". Information Management & Computer Security . 20 (2): 107– 122. doi : 10.1108/09685221211235625 .

Sun, Enbo; Han, Jiaxuan; Li, Yiquan; Huang, Cheng (2 July 2024). "A Packet Content-Oriented Remote Code Execution Attack Payload Detection Model" . Future Internet . 16 (7): 235. doi : 10.3390/fi16070235 .

Jancewicz, Russell J.; Kiayias, Aggelos; Michel, Laurent D.; Russell, Alexander C.; Shvartsman, Alexander A. (2013). "Malicious takeover of voting systems: Arbitrary code execution on optical scan voting terminals". Proceedings of the 28th Annual ACM Symposium on Applied Computing . pp. 1816– 1823. doi : 10.1145/2480362.2480702 . ISBN 978-1-4503-1656-9 .

Advanced persistent threat

Arbitrary code execution

Bombs Fork Logic Time Zip

Browser Helper Objects

Denial-of-service attack

Insecure direct object reference

Remote access trojans

Rogue security software

Application security Secure coding Secure by default Secure by design Misuse case

Secure by design Misuse case

Computer access control Authentication Multi-factor authentication Authorization

Authentication Multi-factor authentication

Multi-factor authentication

Computer security software Antivirus software Security-focused operating system

Security-focused operating system

Data-centric security

Intrusion detection system Host-based intrusion detection system (HIDS) Anomaly detection

Host-based intrusion detection system (HIDS)

Information security management Information risk management Security information and event management (SIEM)

Information risk management

Security information and event management (SIEM)

Runtime application self-protection

Cloud computing security

Governance, risk, and compliance

Identity and access management

Malware analysis and reverse engineering

Security architecture and engineering

Vulnerability management

Cybercrime Cybersex trafficking Computer fraud

Digital rights management

Articles with short description

Short description is different from Wikidata

Articles needing additional references from March 2019

All articles needing additional references

All articles with self-published sources

Articles with self-published sources from January 2025