The memory of a process is divided into different segments. Roughly speaking, memory regions are distinguished by whether they contain data or executable code. Memory pages which are intended to store data are labeled with the No-eXecute (NX) bit. In case an application tries to execute code located in such a page, an error is raised.

Primitive buffer overflows try to execute code on the stack. Due to the fact that the NX bit is set for the memory pages containing the stack, these attacks are prevented. However, it does not defend against ROP attacks reusing existing code¹⁾. Note that once an attacker is able to execute code via ROP, the mprotect()²⁾ function can be used to disable the protection of arbitrary memory regions³⁾.