cve.bz

CWE-134: Use of Externally-Controlled Format String, page 2

Filter

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

What the weakness is: CWE-134 at MITRE. All weaknesses

Related attack patterns (CAPEC): 2
  • CAPEC-67 String Format Overflow in syslog() Likelihood: High · Severity: Very High
  • CAPEC-135 Format String Injection Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-134, as MITRE names them. Credits.

Ask an AI about CWE-134

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-134: Use of Externally-Controlled Format String and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/134.html and https://cve.bz/cve/cwe/134?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.2CVE-2025-68648EPSS 0.6%

    A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.2, FortiAn…

  2. 4.9CVE-2026-0400EPSS 0.5%

    A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall.

  3. 0.6CVE-2025-30269EPSS 0.3%

    A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data or modify memory. We have alrea…

  4. 7.2CVE-2025-64157EPSS 1.5%

    A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0 all versions allows an authenticated admin to execute unauthorized c…

  5. 2.7CVE-2026-21640EPSS 0.3%

    HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a setting, the admin user console could be disabled due to a fata…

  6. 5.3CVE-2025-68949EPSS 0.3%

    n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching instead of exact IP comparison. As a result, an incoming request could be accepte…

  7. –CVE-2025-68816EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, Validate format string parameters Add validation for format string parameters in the firmware tracer to prevent potential security vulnerabilities a…

  8. 5.1CVE-2026-22190EPSS 0.4%

    The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains an uncontrolled format string vulnerability. The -gp (glyph pattern) command-line option is used directly as the format string for sprintf() with only a single…

  9. 1.2CVE-2025-53591EPSS 0.3%

    A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret da…

  10. 9.3CVE-2023-53966EPSS 0.7%

    SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted environment variables. Attackers can manipulate the username environment varia…

  11. 2.7CVE-2025-52666EPSS 0.5%

    Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.

  12. 8.8CVE-2025-48826EPSS 7.2%

    A format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to memory corruption. An attacker can send a series of HTTP requests to trigger th…

  13. 5.1CVE-2025-53407EPSS 0.4%

    A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret da…

  14. 5.1CVE-2025-53406EPSS 0.4%

    A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret da…

  15. 5.1CVE-2025-52429EPSS 0.4%

    A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret da…

  16. 5.1CVE-2025-48730EPSS 0.4%

    A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret da…

  17. 8.8CVE-2025-36202EPSS 0.3%

    IBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to the improper validation of format string strings passed as an argument from an external sou…

  18. 8.4CVE-2010-10017ExploitEPSS 0.4%

    WM Downloader version 3.1.2.2 is vulnerable to a buffer overflow when processing a specially crafted .m3u playlist file. The application fails to properly validate input length, allowing an attacker to overwrite structured exception handle…

  19. 8.8CVE-2025-55298EPSS 4.7%

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user inpu…

  20. 8.7CVE-2011-10029ExploitEPSS 1.1%

    Solar FTP Server fails to properly handle format strings passed to the USER command. When a specially crafted string containing format specifiers is sent, the server crashes due to a read access violation in the __output_1() function of sf…

  21. 9.3CVE-2012-10055ExploitEPSS 2.6%

    ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username containing format specifiers, a remote attacker can overwrite a hardcoded function …

  22. 9.8CVE-2025-40600EPSS 1.0%

    Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption.

  23. 7.2CVE-2025-46123EPSS 1.2%

    An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where the authenticated configuration endpoint `/admin/_conf.jsp` writes the Wi-Fi guest p…

  24. 9.8CVE-2025-46121EPSS 1.3%

    An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addStaFavourite` and `stamgr_cfg_adpt_addStaIot` pass a client hostname directly to snprintf as the for…

  25. 2.3CVE-2025-22482EPSS 0.4%

    A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to obtain secret data or modify memory. We have…

  26. 7.0CVE-2025-48388EPSS 0.4%

    FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insufficient validation of user-supplied data, which is used as arguments to string formatting functions. As a result, an atta…

  27. 7.2CVE-2024-45324EPSS 0.7%

    A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through 7.0.15 and before 6.4.15, FortiProxy version 7.4.0 through 7.4.6, version 7.2.0…

  28. 5.5CVE-2024-55156EPSS 0.2%

    An XML External Entity (XXE) vulnerability in the deserializeArgs() method of Java SDK for CloudEvents v4.0.1 allows attackers to access sensitive information via supplying a crafted XML-formatted event message.

  29. 6.7CVE-2023-40721EPSS 0.2%

    A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests.

  30. 8.4CVE-2025-24359EPSS 0.3%

    ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the `asteval` library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of…

  31. 7.2CVE-2024-12805EPSS 0.7%

    A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution.

  32. 2.1CVE-2024-50403EPSS 0.5%

    A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secr…

  33. 2.1CVE-2024-50402EPSS 0.5%

    A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secr…

  34. 9.1CVE-2024-42330EPSS 0.9%

    The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded fo…

  35. 2.1CVE-2024-50401EPSS 0.6%

    A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secr…

  36. 2.1CVE-2024-50400EPSS 0.6%

    A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secr…

  37. 2.1CVE-2024-50399EPSS 0.6%

    A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secr…

  38. 2.1CVE-2024-50398EPSS 0.6%

    A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secr…

  39. 7.7CVE-2024-50397EPSS 0.6%

    A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to obtain secret data o…

  40. 7.7CVE-2024-50396EPSS 0.7%

    A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to obtain secret data or modify memory. We have al…

  41. 9.3CVE-2024-9129EPSS 0.4%

    In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. Reported by Dylan Marino

  42. 7.2CVE-2024-45330EPSS 0.6%

    A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privileges via specially crafted requests.

  43. 8.7CVE-2024-39529EPSS 0.5%

    A Use of Externally-Controlled Format String vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If DNS Dom…

  44. 9.8CVE-2024-4641EPSS 0.3%

    OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an argument. An attacker could modify an externally controlled format string to caus…

  45. 8.8CVE-2024-6145EPSS 1.2%

    Actiontec WCB6200Q Cookie Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Actiontec WCB6200Q routers. Authentication is not requ…

  46. 9.1CVE-2024-35845EPSS 1.2%

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL termination The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated correctly before using it.

  47. 7.2CVE-2023-45583EPSS 0.7%

    A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiPAM 1.1.0, FortiPAM 1.0 all versions, For…

  48. 6.7CVE-2023-36640EPSS 0.3%

    A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through 6.0.16, FortiPAM 1.1.0, …

  49. 5.5CVE-2021-34970EPSS 0.3%

    Foxit PDF Reader print Method Use of Externally-Controlled Format String Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User…

  50. 5.7CVE-2024-23914EPSS 0.3%

    Use of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows. When MC_Open_Association() function is used to open DICOM Association and gets DICOM Application Context Name with illegal characters, it mi…