DEP.

Data Execution Prevention (also called NX or W^X) marks memory pages as non-executable so attackers cannot run shellcode injected into the stack or heap. It belongs to the Application Security category of cybersecurity.

Data Execution Prevention (also called NX or W^X) marks memory pages as non-executable so attackers cannot run shellcode injected into the stack or heap.

DEP, sometimes called NX (No-eXecute) or W^X (Write XOR Execute), enforces that any memory page is either writable or executable but never both. The CPU's NX bit blocks instruction fetches from data pages such as the stack and heap, defeating classic shellcode-injection attacks. AMD introduced the hardware bit in 2003 and Intel followed shortly after; software DEP was added to Windows XP SP2 and to Linux via PaX/grsecurity, then mainlined. Because DEP eliminates direct code execution from data, attackers shifted to code-reuse techniques like return-to-libc and ROP, which is why DEP is paired with ASLR, CFI, and shadow stacks.

Defences for DEP typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: NX, No-Execute, W^X.