A security analyst reviews a crash report for a custom C application. The report shows that when a user submitted 300 characters into a field designed to accept a 64-character username, the program crashed and the instruction pointer was overwritten with attacker-supplied data, allowing arbitrary code execution. Which vulnerability does this describe?