CWE-134— Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.— MITRE CWE catalog
426 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-134page 8 of 9
- CVE-2020-15634MEDIUMCVSS 6.3EG 6.32020-08-20
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific fl…
- CVE-2026-15961MEDIUMCVSS 6.0EG 6.02026-08-19
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 IBM PowerVM could allow a local attacker to obtain sensitive information or cause a denial of service due to improper control of format strings.
- CVE-2022-2652MEDIUMCVSS 6.0EG 6.02022-08-04
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request …
- CVE-2013-2851MEDIUMCVSS v2 6.0EG 6.02013-06-07
Format string vulnerability in the register_disk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/md_mod/paramet…
- CVE-2008-1127MEDIUMCVSS v2 6.0EG 6.02008-03-03
Format string vulnerability in the cryactio function in Crysis 1.1.1.5879 allows remote authenticated users to execute arbitrary code via format string specifiers in the user name, which is triggered when the game character is killed.
- CVE-2004-2714MEDIUMCVSS v2 6.0EG 6.02004-12-31
Unspecified vulnerability in Window Maker 0.80.2 and earlier allows attackers to perform unknown actions via format string specifiers in a font specification in WMGLOBAL, probably a format string vulnerability.
- CVE-2008-7160MEDIUMCVSS v2 5.8EG 5.82009-09-10
The silc_http_server_parse function in lib/silchttp/silchttpserver.c in the internal HTTP server in silcd in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.9 allows remote attackers to overwrite a stack location and possibly e…
- CVE-2008-7159MEDIUMCVSS v2 5.8EG 5.82009-09-10
The silc_asn1_encoder function in lib/silcasn1/silcasn1_encode.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.8 allows remote attackers to overwrite a stack location and possibly execute arbitrary code via a crafted OID v…
- CVE-2008-1333MEDIUMCVSS v2 5.8EG 5.82008-03-20
Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call, or (2) the astm…
- CVE-2024-23914MEDIUMCVSS 5.7EG 5.72024-05-03
Use of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows. When MC_Open_Association() function is used to open DICOM Association and gets DICOM Application Context Name with illegal characters, it mi…
- CVE-2023-6399MEDIUMCVSS 5.7EG 5.72024-02-20
A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, U…
- CVE-2026-46465MEDIUMCVSS 5.5EG 5.52026-07-03
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of external…
- CVE-2026-6843MEDIUMCVSS 5.5EG 5.52026-04-22
A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading t…
- CVE-2024-55156MEDIUMCVSS 5.5EG 5.52025-02-21
An XML External Entity (XXE) vulnerability in the deserializeArgs() method of Java SDK for CloudEvents v4.0.1 allows attackers to access sensitive information via supplying a crafted XML-formatted event message.
- CVE-2021-34970MEDIUMCVSS 5.5EG 5.52024-05-07
Foxit PDF Reader print Method Use of Externally-Controlled Format String Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User…
- CVE-2019-13318MEDIUMCVSS 5.5EG 5.52019-10-04
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o…
- CVE-2018-15749MEDIUMCVSS 5.5EG 5.52018-09-06
The Pulse Secure Desktop (macOS) 5.3RX before 5.3R5 and 9.0R1 has a Format String Vulnerability.
- CVE-2017-17132MEDIUMCVSS 5.5EG 5.52018-03-05
Huawei VP9660 V500R002C10 has a uncontrolled format string vulnerability when the license module output the log information. An authenticated local attacker could exploit this vulnerability to cause a denial of service.
- CVE-2021-3442MEDIUMCVSS 5.4EG 5.42022-08-22
A flaw was found in the Red Hat OpenShift API Management product. User input is not validated allowing an authenticated user to inject scripts into some text boxes leading to a XSS attack. The highest threat from this vulnerability is to d…
- CVE-2008-1357MEDIUMCVSS v2 5.4EG 5.42008-03-17
Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of ser…
- CVE-2025-68949MEDIUMCVSS 5.3EG 5.32026-01-13
n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching instead of exact IP comparison. As a result, an incoming request could be accep…
- CVE-2021-37735MEDIUMCVSS 5.3EG 5.32021-10-12
A remote denial of service vulnerability was discovered in Aruba Instant version(s): Aruba Instant 6.5.x.x: 6.5.4.18 and below; Aruba Instant 8.5.x.x: 8.5.0.10 and below; Aruba Instant 8.6.x.x: 8.6.0.4 and below. Aruba has released patches…
- CVE-2021-32785MEDIUMCVSS 5.3EG 5.32021-07-22
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2…
- CVE-2015-9238MEDIUMCVSS 5.3EG 5.32018-05-31
secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.
- CVE-2015-2894MEDIUMCVSS 5.3EG 5.32015-12-31
Format string vulnerability in the up.time client in Idera Uptime Infrastructure Monitor 6.0 and 7.2 allows remote attackers to cause a denial of service (application crash) via format string specifiers.
- CVE-2007-4550MEDIUMCVSS v2 5.1EG 5.12007-08-28
Format string vulnerability in ALPass 2.7 English and 3.02 Korean might allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an fnm field in a folder-name record in an ALPASS DB (APW) file.
- CVE-2006-2480MEDIUMCVSS v2 5.1EG 5.12006-05-19
Format string vulnerability in Dia 0.94 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering errors or warnings, as demonstrated via format string specifiers in a .bmp filena…
- CVE-2006-0082MEDIUMCVSS v2 5.1EG 5.12006-01-04
Format string vulnerability in the SetImageInfo function in image.c for ImageMagick 6.2.3 and other versions, and GraphicsMagick, allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a…
- CVE-2013-2131MEDIUMCVSS v2 5.0EG 5.02015-01-04
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.
- CVE-2013-7386MEDIUMCVSS v2 5.0EG 5.02014-06-02
Format string vulnerability in the PROJECT::write_account_file function in client/cs_account.cpp in BOINC, possibly 7.2.33, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via format string s…
- CVE-2013-6809MEDIUMCVSS v2 5.0EG 5.02013-12-13
Format string vulnerability in the client in Tftpd32 before 4.50 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in the Remote File field.
- CVE-2013-3560MEDIUMCVSS v2 5.0EG 5.02013-05-25
The dissect_dsmcc_un_download function in epan/dissectors/packet-mpeg-dsmcc.c in the MPEG DSM-CC dissector in Wireshark 1.8.x before 1.8.7 uses an incorrect format string, which allows remote attackers to cause a denial of service (applica…
- CVE-2012-1152MEDIUMCVSS v2 5.0EG 5.02012-09-09
Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and perl-YAML-LibYAML) module 0.38 for Perl allow remote attackers to cause a denial of service (process crash) via format s…
- CVE-2012-1151MEDIUMCVSS v2 5.0EG 5.02012-09-09
Multiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.19.0 for Perl allow remote PostgreSQL database servers to cause a denial of service (process crash) via format string specifiers i…
- CVE-2009-4811MEDIUMCVSS v2 5.0EG 5.02010-04-27
VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459, VMware Player 3.0 before 3.0.1 build 227600 and 2.5.x before …
- CVE-2010-0743MEDIUMCVSS v2 5.0EG 5.02010-04-08
Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial …
- CVE-2009-3707MEDIUMCVSS v2 5.0EG 5.02009-10-16
VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459, VMware Player 3.0 before 3.0.1 build 227600 and 2.5.x before …
- CVE-2009-3294MEDIUMCVSS v2 5.0EG 5.02009-09-22
The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) "e" or (2…
- CVE-2009-3275MEDIUMCVSS v2 5.0EG 5.02009-09-21
Blocks/Common/Src/Configuration/Manageability/Adm/AdmContentBuilder.cs in Microsoft patterns & practices Enterprise Library (aka EntLib) allows context-dependent attackers to cause a denial of service (CPU consumption) via an input string …
- CVE-2007-6625MEDIUMCVSS v2 5.0EG 5.02008-01-04
The Platform Service Process (asampsp) in Fan-Out Driver Platform Services for Novell Identity Manager (IDM) 3.5.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified network traffic that triggers a syslog m…
- CVE-2006-6751MEDIUMCVSS v2 5.0EG 5.02006-12-27
Format string vulnerability in XM Easy Personal FTP Server 5.2.1 allows remote attackers to cause a denial of service (application crash) via format string specifiers in the USER command or certain other available or nonexistent commands. …
- CVE-2006-0743MEDIUMCVSS v2 5.0EG 5.02006-03-09
Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors.
- CVE-2026-94520MEDIUMCVSS 4.9EG 4.92026-10-13
Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.
- CVE-2026-0400MEDIUMCVSS 4.9EG 4.92026-02-24
A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall.
- CVE-2009-0538MEDIUMCVSS v2 4.6EG 4.62009-03-18
Format string vulnerability in Symantec pcAnywhere before 12.5 SP1 allows local users to read and modify arbitrary memory locations, and cause a denial of service (application crash) or possibly have unspecified other impact, via format st…
- CVE-2008-1658MEDIUMCVSS v2 4.6EG 4.62008-04-11
Format string vulnerability in the grant helper (polkit-grant-helper.c) in PolicyKit 0.7 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in a password.
- CVE-2007-4273MEDIUMCVSS v2 4.6EG 4.62007-08-18
IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allows local users to create arbitrary directories and execute arbitrary code via a "crafted localized message file" that enables a format string attack, possibly involving the (1) OSS…
- CVE-2006-1471MEDIUMCVSS v2 4.6EG 4.62006-06-27
Format string vulnerability in the CF_syslog function launchd in Apple Mac OS X 10.4 up to 10.4.6 allows local users to execute arbitrary code via format string specifiers that are not properly handled in a syslog call in the logging facil…
- CVE-2006-2409MEDIUMCVSS v2 4.6EG 4.62006-05-16
Format string vulnerability in the raydium_log function in console.c in Raydium before SVN revision 310 allows local users to execute arbitrary code via format string specifiers in the format parameter, which are not properly handled in a …
- CVE-2026-6539MEDIUMCVSS 4.4EG 4.42026-04-30
Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attac…
Map vulnerabilities like CWE-134 to your infrastructure
EchelonGraph correlates every CVE — across CWE-134 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →