After learning about buffer overflows: In the 90's finding a buffer overflow nearly always meant you could exploit it.
Nowadays there are a lot of protection mechanisms like address layout space randomization, making memory either executable or writeable, stack cookies, ...
It seems to me that with only 1 protection mechanism in place, you can get around it (for example with return orientated programming). But when you combine these protection mechanisms, the door is pretty much shut down. And if someone finds an overflowable buffer there is a 95 percent chance it's not exploitable.
It seems to me that the only way buffer overflows are reliably exploitable is if these protections are not in place, but operating systems force these protections
So are buffer overflow attacks pretty much dead nowadays?