noexecute

Noexecute is a hardware-assisted memory protection feature that prevents code from executing in designated regions of memory. It is widely known by the tag NX (No-eXecute) on x86 processors and XN (Execute-Never) on ARM architectures. When memory is marked as non-executable, attempting to fetch and run instructions from that region triggers a fault, typically terminating the offending process. Noexecute is a core component of data execution prevention (DEP) and is used to reduce the risk of exploits that inject code into data areas such as the stack, heap, or memory-mapped regions.

Implementation and usage: The feature is implemented via page-table entries or memory attributes; the OS marks pages as executable or non-executable; CPUs enforce the rule at instruction fetch. Modern operating systems enable noexecute by default for stack and heap allocations and for user-space memory, with some exceptions for just-in-time compilation or native code generation that legitimately needs executable pages; these may be granted via specific mappings or permissions.

Platform support and notes: All major architectures support noexecute in some form; Windows implements DEP, Linux uses the NX bit/DEP, macOS uses similar protections. Some older systems may have limited support. Noexecute is not a panacea; it does not prevent all memory safety problems and can be circumvented by techniques such as return-oriented programming or if a page is misconfigured. It is commonly used in combination with ASLR, stack canaries, and other mitigations to improve security.