Buffer overflow attacks are prevented by altering the load locations of commonly used executable code modules. A monitor layer (210) is associated with an operating system (220) and controls the load locations for predetermined modules containing executable code that can be used in the execution of buffer overflow attacks. The monitor layer (210) applies predetermined criteria to determine whether a module (280) presents a high risk for enabling a buffer overflow attack. If the monitor layer (210) determines that the module (280) presents a high risk, the monitor layer (210) may force the module (280) to load in an alternate location (290) by reserving sections of memory (295) into which the module normally loads. Alternatively, the monitor layer (210) may alter the area of the module that directs the operating system (220) to load it into a particular location (295), thus causing the operation system to load the module to an alternate location (290).