OSCP Buffer Overflow Module in 2026: Is It Still Required and How to Prepare

The reasoning behind the change, as Offensive Security has described it publicly, is that the dedicated buffer overflow machine had become a memorisation drill rather than an offensive thinking drill. The stated goal of the OSCP is to test whether a candidate can compromise a system they have never seen, not whether they can repeat a fixed step-by-step recipe. ...A common pattern reported by candidates who sat the legacy exam is failing on a first attempt because a buffer overflow exploit produced a non-interactive shell that died after every command, then passing on a retake under the new format by focusing on the full Active Directory chain and completing two of the three standalone targets rather than chasing all three. Another recurring pattern involves candidates failing an early attempt because they under-budgeted time for the Active Directory chain, then passing on a later attempt after practising the full GOAD lab end to end and learning to recognise a child-domain to forest-root escalation path quickly.