CWE-134— Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.— MITRE CWE catalog

433 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-134page 7 of 9

CVE-2008-0989MEDIUMCVSS v2 6.9EG 6.9
2008-03-18
Format string vulnerability in mDNSResponderHelper in Apple Mac OS X 10.5.2 allows local users to execute arbitrary code via format string specifiers in the local hostname.
CVE-2026-120059MEDIUMCVSS 6.8EG 6.8
2026-11-02
For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument whil…
CVE-2026-6390MEDIUMCVSS 6.8EG 6.8
2026-07-23
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. T…
CVE-2026-6242MEDIUMCVSS 6.8EG 6.8
2026-06-05
An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An attacker may inject crafted format strings into…
CVE-2026-6241MEDIUMCVSS 6.8EG 6.8
2026-06-05
An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifi…
CVE-2022-43619MEDIUMCVSS 6.8EG 6.8
2023-03-29
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechan…
CVE-2014-8625MEDIUMCVSS v2 6.8EG 6.8
2015-01-20
Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in th…
CVE-2014-1315MEDIUMCVSS v2 6.8EG 6.8
2014-04-23
Format string vulnerability in CoreServicesUIAgent in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a URL.
CVE-2014-1683MEDIUMCVSS v2 6.8EG 6.8
2014-01-29
The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the…
CVE-2012-4426MEDIUMCVSS v2 6.8EG 6.8
2012-11-21
Multiple format string vulnerabilities in mcrypt 2.6.8 and earlier might allow user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving (1) errors.c or (2) mcrypt.c.
CVE-2011-0173MEDIUMCVSS v2 6.8EG 6.8
2011-03-23
Multiple format string vulnerabilities in AppleScript in Apple Mac OS X before 10.6.7 allow context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a (1) displa…
CVE-2010-4013MEDIUMCVSS v2 6.8EG 6.8
2011-01-10
Format string vulnerability in PackageKit in Apple Mac OS X 10.6.x before 10.6.6 allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to interaction between Softw…
CVE-2010-2950MEDIUMCVSS v2 6.8EG 6.8
2010-09-28
Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI tha…
CVE-2010-1376MEDIUMCVSS v2 6.8EG 6.8
2010-06-17
Multiple format string vulnerabilities in Network Authorization in Apple Mac OS X 10.6 before 10.6.4 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a (1) af…
CVE-2010-2094MEDIUMCVSS v2 6.8EG 6.8
2010-05-27
Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is …
CVE-2008-5660MEDIUMCVSS v2 6.8EG 6.8
2008-12-17
Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might allow remote attackers to execute arbitrary code via format string specifiers in a crafted…
CVE-2008-2310MEDIUMCVSS v2 6.8EG 6.8
2008-07-01
Format string vulnerability in c++filt in Apple Mac OS X 10.5 before 10.5.4 allows user-assisted attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string in (1) C++ or (2) Java source code.
CVE-2008-1705MEDIUMCVSS v2 6.8EG 6.8
2008-04-09
Format string vulnerability in the logging function in IBM solidDB 06.00.1018 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the (1) user name, (2) peer name, and possibly unspecified other fi…
CVE-2008-1206MEDIUMCVSS v2 6.8EG 6.8
2008-03-08
Format string vulnerability in the log_message function in lks.c in Linux Kiss Server 1.2, when background (daemon) mode is disabled, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string …
CVE-2008-0072MEDIUMCVSS v2 6.8EG 6.8
2008-03-06
Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version fi…
CVE-2007-6183MEDIUMCVSS v2 6.8EG 6.8
2007-11-30
Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via forma…
CVE-2007-5396MEDIUMCVSS v2 6.8EG 6.8
2007-11-10
Format string vulnerability in the ext_yahoo_contact_added function in yahoo.c in Miranda IM 0.7.1 allows remote attackers to execute arbitrary code via a Y7 Buddy Authorization packet with format string specifiers in the contact Yahoo! h…
CVE-2007-0051MEDIUMCVSS v2 6.8EG 6.8
2007-01-04
Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows remote user-assisted attackers to execute arbitrary code via a crafted photocast with format string specifiers in the title of an RSS iPhoto f…
CVE-2007-0017MEDIUMCVSS v2 6.8EG 6.8
2007-01-03
Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c…
CVE-2004-0179MEDIUMCVSS v2 6.8EG 6.8
2004-06-01
Multiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other products that use neon including (2) Cadaver, (3) Subversion, and (4) OpenOffice, allow remote malicious WebDAV servers to execute arbitrary code.
CVE-2003-1381MEDIUMCVSS v2 6.8EG 6.8
2003-12-31
Format string vulnerability in AMX 0.9.2 and earlier, a plugin for Valve Software's Half-Life Server, allows remote attackers to execute arbitrary commands via format string specifiers in the amx_say command.
CVE-2023-40721MEDIUMCVSS 6.7EG 6.7
2025-02-11
A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests.
CVE-2023-36640MEDIUMCVSS 6.7EG 6.7
2024-05-14
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through 6.0.16, FortiPAM 1.1.0, …
CVE-2023-48784MEDIUMCVSS 6.7EG 6.7
2024-04-09
A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all versions, 6.4 all versions command line interface may allow a local privileged attacker with super-…
CVE-2023-41842MEDIUMCVSS 6.7EG 6.7
2024-03-12
A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute unauthorized code or commands via specially crafted command arguments.
CVE-2022-43953MEDIUMCVSS 6.7EG 6.7
2023-06-13
A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions 6.4, FortiOS all versions 6.2, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 th…
CVE-2026-76729MEDIUMCVSS 6.6EG 6.6
2026-09-29
A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an a…
CVE-2026-3008MEDIUMCVSS 6.6EG 6.6
2026-04-27
Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application.
CVE-2026-69395MEDIUMCVSS 6.5EG 6.5
2026-09-08
Use of externally-controlled format string in Active Directory Certificate Services (AD CS) allows an authorized attacker to disclose information over a network.
CVE-2025-53591MEDIUMCVSS 6.5EG 6.5
2026-01-02
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret da…
CVE-2025-53407MEDIUMCVSS 6.5EG 6.5
2025-10-03
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret da…
CVE-2025-53406MEDIUMCVSS 6.5EG 6.5
2025-10-03
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret da…
CVE-2025-52429MEDIUMCVSS 6.5EG 6.5
2025-10-03
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret da…
CVE-2025-48730MEDIUMCVSS 6.5EG 6.5
2025-10-03
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret da…
CVE-2025-48388MEDIUMCVSS 6.5EG 6.5
2025-05-29
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insufficient validation of user-supplied data, which is used as arguments to string formatting functions. As a result, an atta…
CVE-2023-22923MEDIUMCVSS 6.5EG 6.5
2023-05-01
A format string vulnerability in a binary of the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated attacker to cause denial-of-service (DoS) conditions on an affected device.
CVE-2022-43869MEDIUMCVSS 6.5EG 6.5
2023-02-12
IBM Spectrum Scale (5.1.0.0 through 5.1.2.8 and 5.1.3.0 through 5.1.5.1) and IBM Elastic Storage System (6.1.0.0 through 6.1.2.4 and 6.1.3.0 through 6.1.4.1) could allow an authenticated user to cause a denial of service through the GUI us…
CVE-2021-28846MEDIUMCVSS 6.5EG 6.5
2021-08-10
A Format String vulnerablity exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could let a remote malicious user cause a denial of service due to a logic bug at address 0x40d…
CVE-2019-18420MEDIUMCVSS 6.5EG 6.5
2019-10-31
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function which uses a printf-like format string to i…
CVE-2018-14661MEDIUMCVSS 6.5EG 6.5
2018-10-31
It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage, was vulnerable to a format string attack. A remote, authenticated attacker could use this flaw to …
CVE-2016-1895MEDIUMCVSS 6.5EG 6.5
2017-09-01
NetApp Data ONTAP before 8.2.5 and 8.3.x before 8.3.2P12 allow remote authenticated users to cause a denial of service via vectors related to unsafe user input string handling.
CVE-2022-26392MEDIUMCVSS 3.1EG 6.5
2022-09-09
The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to…
CVE-2006-0705MEDIUMCVSS v2 6.5EG 6.5
2006-02-15
Format string vulnerability in a logging function as used by various SFTP servers, including (1) AttachmateWRQ Reflection for Secure IT UNIX Server before 6.0.0.9, (2) Reflection for Secure IT Windows Server before 6.0 build 38, (3) F-Secu…
CVE-2015-6285MEDIUMCVSS v2 6.4EG 6.4
2015-09-14
Format string vulnerability in Cisco Email Security Appliance (ESA) 7.6.0 and 8.0.0 allows remote attackers to cause a denial of service (memory overwrite or service outage) via format string specifiers in an HTTP request, aka Bug ID CSCug…
CVE-2006-1840MEDIUMCVSS v2 6.4EG 6.4
2006-04-19
Multiple format string vulnerabilities in Empire Server before 4.3.1 allow attackers to cause a denial of service (crash) via the (1) load, (2) spy and (3) bomb functions.

Map vulnerabilities like CWE-134 to your infrastructure

EchelonGraph correlates every CVE — across CWE-134 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →