Buffer overflow in terms of IP security, external or internal vulnerability?

Question

Information Security

To clarify, a buffer overflow in the IS of a company that is undergoing an ISO 27001 audit. Now this vulnerability is internal or external for her.
For example, from the point of view of 27001, if the server room is not protected, and the server can be stolen, then this is an external vulnerability,
but the server disk overflow vulnerability is internal.

Answer 1

If the overflow occurs in the local program, then the internal one.
If it is called on a web server and is called by a specially designed request, then it is external.

Answer 2

Buffer overflows are a class of programming errors that can lead to vulnerabilities. Whether it leads to a vulnerability and to which one depends on where exactly this buffer overflow occurs and by whom, how and through which vector it can be exploited.

Answer 3

According to the ISO 27001 standard, it is actually an internal vulnerability.
Specifically, assets have internal (or intrinsic) and external (or extrinsic) vulnerabilities. For example, with respect to information and communication technology (ICT), intrinsic vulnerabilities can be found within system design, security configurations, hardware, and software, among other areas (ENISA, 2017).
https://www.unodc.org/e4j/en/cybercrime/module-9/k...