CWE-134— Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.— MITRE CWE catalog

426 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-134page 7 of 9

CVE-2026-6241MEDIUMCVSS 6.8EG 6.8
2026-06-05
An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifi…
CVE-2022-43619MEDIUMCVSS 6.8EG 6.8
2023-03-29
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechan…
CVE-2014-8625MEDIUMCVSS v2 6.8EG 6.8
2015-01-20
Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in th…
CVE-2014-1315MEDIUMCVSS v2 6.8EG 6.8
2014-04-23
Format string vulnerability in CoreServicesUIAgent in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a URL.
CVE-2014-1683MEDIUMCVSS v2 6.8EG 6.8
2014-01-29
The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the…
CVE-2012-4426MEDIUMCVSS v2 6.8EG 6.8
2012-11-21
Multiple format string vulnerabilities in mcrypt 2.6.8 and earlier might allow user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving (1) errors.c or (2) mcrypt.c.
CVE-2011-0173MEDIUMCVSS v2 6.8EG 6.8
2011-03-23
Multiple format string vulnerabilities in AppleScript in Apple Mac OS X before 10.6.7 allow context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a (1) displa…
CVE-2010-4013MEDIUMCVSS v2 6.8EG 6.8
2011-01-10
Format string vulnerability in PackageKit in Apple Mac OS X 10.6.x before 10.6.6 allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to interaction between Softw…
CVE-2010-2950MEDIUMCVSS v2 6.8EG 6.8
2010-09-28
Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI tha…
CVE-2010-1376MEDIUMCVSS v2 6.8EG 6.8
2010-06-17
Multiple format string vulnerabilities in Network Authorization in Apple Mac OS X 10.6 before 10.6.4 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a (1) af…
CVE-2010-2094MEDIUMCVSS v2 6.8EG 6.8
2010-05-27
Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is …
CVE-2008-5660MEDIUMCVSS v2 6.8EG 6.8
2008-12-17
Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might allow remote attackers to execute arbitrary code via format string specifiers in a crafted…
CVE-2008-2310MEDIUMCVSS v2 6.8EG 6.8
2008-07-01
Format string vulnerability in c++filt in Apple Mac OS X 10.5 before 10.5.4 allows user-assisted attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string in (1) C++ or (2) Java source code.
CVE-2008-1705MEDIUMCVSS v2 6.8EG 6.8
2008-04-09
Format string vulnerability in the logging function in IBM solidDB 06.00.1018 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the (1) user name, (2) peer name, and possibly unspecified other fi…
CVE-2008-1206MEDIUMCVSS v2 6.8EG 6.8
2008-03-08
Format string vulnerability in the log_message function in lks.c in Linux Kiss Server 1.2, when background (daemon) mode is disabled, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string …
CVE-2008-0072MEDIUMCVSS v2 6.8EG 6.8
2008-03-06
Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version fi…
CVE-2007-6183MEDIUMCVSS v2 6.8EG 6.8
2007-11-30
Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via forma…
CVE-2007-5396MEDIUMCVSS v2 6.8EG 6.8
2007-11-10
Format string vulnerability in the ext_yahoo_contact_added function in yahoo.c in Miranda IM 0.7.1 allows remote attackers to execute arbitrary code via a Y7 Buddy Authorization packet with format string specifiers in the contact Yahoo! h…
CVE-2007-0051MEDIUMCVSS v2 6.8EG 6.8
2007-01-04
Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows remote user-assisted attackers to execute arbitrary code via a crafted photocast with format string specifiers in the title of an RSS iPhoto f…
CVE-2007-0017MEDIUMCVSS v2 6.8EG 6.8
2007-01-03
Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c…
CVE-2004-0179MEDIUMCVSS v2 6.8EG 6.8
2004-06-01
Multiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other products that use neon including (2) Cadaver, (3) Subversion, and (4) OpenOffice, allow remote malicious WebDAV servers to execute arbitrary code.
CVE-2003-1381MEDIUMCVSS v2 6.8EG 6.8
2003-12-31
Format string vulnerability in AMX 0.9.2 and earlier, a plugin for Valve Software's Half-Life Server, allows remote attackers to execute arbitrary commands via format string specifiers in the amx_say command.
CVE-2023-40721MEDIUMCVSS 6.7EG 6.7
2025-02-11
A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests.
CVE-2023-36640MEDIUMCVSS 6.7EG 6.7
2024-05-14
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through 6.0.16, FortiPAM 1.1.0, …
CVE-2023-48784MEDIUMCVSS 6.7EG 6.7
2024-04-09
A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all versions, 6.4 all versions command line interface may allow a local privileged attacker with super-…
CVE-2023-41842MEDIUMCVSS 6.7EG 6.7
2024-03-12
A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute unauthorized code or commands via specially crafted command arguments.
CVE-2022-43953MEDIUMCVSS 6.7EG 6.7
2023-06-13
A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions 6.4, FortiOS all versions 6.2, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 th…
CVE-2026-76729MEDIUMCVSS 6.6EG 6.6
2026-09-29
A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an a…
CVE-2026-3008MEDIUMCVSS 6.6EG 6.6
2026-04-27
Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application.
CVE-2026-69395MEDIUMCVSS 6.5EG 6.5
2026-09-08
Use of externally-controlled format string in Active Directory Certificate Services (AD CS) allows an authorized attacker to disclose information over a network.
CVE-2025-53591MEDIUMCVSS 6.5EG 6.5
2026-01-02
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret da…
CVE-2025-53407MEDIUMCVSS 6.5EG 6.5
2025-10-03
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret da…
CVE-2025-53406MEDIUMCVSS 6.5EG 6.5
2025-10-03
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret da…
CVE-2025-52429MEDIUMCVSS 6.5EG 6.5
2025-10-03
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret da…
CVE-2025-48730MEDIUMCVSS 6.5EG 6.5
2025-10-03
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret da…
CVE-2025-48388MEDIUMCVSS 6.5EG 6.5
2025-05-29
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insufficient validation of user-supplied data, which is used as arguments to string formatting functions. As a result, an atta…
CVE-2023-22923MEDIUMCVSS 6.5EG 6.5
2023-05-01
A format string vulnerability in a binary of the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated attacker to cause denial-of-service (DoS) conditions on an affected device.
CVE-2022-43869MEDIUMCVSS 6.5EG 6.5
2023-02-12
IBM Spectrum Scale (5.1.0.0 through 5.1.2.8 and 5.1.3.0 through 5.1.5.1) and IBM Elastic Storage System (6.1.0.0 through 6.1.2.4 and 6.1.3.0 through 6.1.4.1) could allow an authenticated user to cause a denial of service through the GUI us…
CVE-2021-28846MEDIUMCVSS 6.5EG 6.5
2021-08-10
A Format String vulnerablity exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could let a remote malicious user cause a denial of service due to a logic bug at address 0x40d…
CVE-2019-18420MEDIUMCVSS 6.5EG 6.5
2019-10-31
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function which uses a printf-like format string to i…
CVE-2018-14661MEDIUMCVSS 6.5EG 6.5
2018-10-31
It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage, was vulnerable to a format string attack. A remote, authenticated attacker could use this flaw to …
CVE-2016-1895MEDIUMCVSS 6.5EG 6.5
2017-09-01
NetApp Data ONTAP before 8.2.5 and 8.3.x before 8.3.2P12 allow remote authenticated users to cause a denial of service via vectors related to unsafe user input string handling.
CVE-2022-26392MEDIUMCVSS 3.1EG 6.5
2022-09-09
The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to…
CVE-2006-0705MEDIUMCVSS v2 6.5EG 6.5
2006-02-15
Format string vulnerability in a logging function as used by various SFTP servers, including (1) AttachmateWRQ Reflection for Secure IT UNIX Server before 6.0.0.9, (2) Reflection for Secure IT Windows Server before 6.0 build 38, (3) F-Secu…
CVE-2015-6285MEDIUMCVSS v2 6.4EG 6.4
2015-09-14
Format string vulnerability in Cisco Email Security Appliance (ESA) 7.6.0 and 8.0.0 allows remote attackers to cause a denial of service (memory overwrite or service outage) via format string specifiers in an HTTP request, aka Bug ID CSCug…
CVE-2006-1840MEDIUMCVSS v2 6.4EG 6.4
2006-04-19
Multiple format string vulnerabilities in Empire Server before 4.3.1 allow attackers to cause a denial of service (crash) via the (1) load, (2) spy and (3) bomb functions.
CVE-2006-0771MEDIUMCVSS v2 6.4EG 6.4
2006-02-18
Format string vulnerability in PunkBuster 1.180 and earlier, as used by Soldier of Fortune II and possibly other games, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format stri…
CVE-2025-10262MEDIUMCVSS 6.3EG 6.3
2026-06-16
Nokia SR Linux is vulnerable to local privilege escalation vulnerability due to unsanitized format validation. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privi…
CVE-2024-4641MEDIUMCVSS 6.3EG 6.3
2024-06-25
OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an argument. An attacker could modify an externally controlled format string to caus…
CVE-2023-25492MEDIUMCVSS 6.3EG 6.3
2023-05-01
A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API.

Map vulnerabilities like CWE-134 to your infrastructure

EchelonGraph correlates every CVE — across CWE-134 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →