What is an unchecked buffer?

It usually means unchecked for length. In this mode, the incoming data is flowed into the buffer with the unstated assumption that the buffer will be big enough to hold the incoming data. This is a program vulnerability, since a malicious user couldprovide a very long input string, part of which was actually bytes of binary machine language instructions. Since the buffer length is not checked, the input bytes in excess of the buffer length overlays (wipes out) whatever follows the buffer. If this is a code segment (eventually), then the user's code could get executed.

Clearly the attacker needs a good knowledge of the program and of assembly language to successfully execute code, but any long input will wipe out *something* after the buffer, such as other variables, or code and the result will probably not be pretty.

Hope this helps.