CWE-123 · Memory Corruption
Write-what-where Condition
65CVEs
SortMost likely exploited
65 CVEs with CWE-123 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-46300In CISA KEVExploitednet: skbuff: preserve shared-frag marker during coalescingLinux · Linux · CVSS 7.8 · 2026-05-23 | 7.8 | 16% | 2026-05-23 |
| CVE-2025-22225In CISA KEVExploitedVMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the s…VMware · VMware ESXi · CVSS 8.2 · 2025-03-04 | 8.2 | 1.0% | 2025-03-04 |
| CVE-2026-43284xfrm: esp: avoid in-place decrypt on shared skb fragsLinux · Linux · CVSS 8.8 · 2026-05-08 | 8.8 | 94% | 2026-05-08 |
| CVE-2015-8271The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.Rtmpdump Project · Rtmpdump · 2017-04-13 | – | 5.9% | 2017-04-13 |
| CVE-2017-10994Foxit Reader before 8.3.1 and PhantomPDF before 8.3.1 have an Arbitrary Write vulnerability, which allows remote attackers to execute arbitrary code via a crafted document.Foxitsoftware · Foxit Reader · 2017-07-07 | – | 4.9% | 2017-07-07 |
| CVE-2025-55298ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code executionImageMagick · ImageMagick · CVSS 7.5 · 2025-08-26 | 7.5 | 4.7% | 2025-08-26 |
| CVE-2014-5435An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, that could le…Honeywell · Experion PKS · 2019-04-08 | – | 3.5% | 2019-04-08 |
| CVE-2024-42479llama.cpp allows write-what-where in rpc_server::set_tensorggerganov · llama.cpp · CVSS 10 · 2024-08-12 | 10.0 | 2.6% | 2024-08-12 |
| CVE-2021-38441Eclipse CycloneDDS Write-what-where ConditionEclipse · CycloneDDS · CVSS 6.6 · 2022-05-05 | 6.6 | 2.1% | 2022-05-05 |
| CVE-2020-16225Delta Electronics TPEditor Versions 1.97 and prior. A write-what-where condition may be exploited by processing a specially crafted project file. Successful exploitation of this v…Deltaww · Delta Electronics TPEditor · 2020-08-06 | – | 2.1% | 2020-08-06 |
| CVE-2022-38143A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. A specially-crafted bmp file can write to arbitrary out of bound…OpenImageIO Project · OpenImageIO · CVSS 9.8 · 2022-12-23 | 9.8 | 1.5% | 2022-12-23 |
| CVE-2020-7560A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Expert) (all versions),…Schneider-Electric · EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStr… · 2020-12-11 | – | 1.4% | 2020-12-11 |
| CVE-2020-2001PAN-OS: Panorama External control of file vulnerability leads to privilege escalationPalo Alto Networks · PAN-OS · CVSS 8.1 · 2020-05-13 | 8.1 | 1.4% | 2020-05-13 |
| CVE-2021-38449AUVESY VersiondogAUVESY · Versiondog · CVSS 9.8 · 2021-10-22 | 9.8 | 1.3% | 2021-10-22 |
| CVE-2024-2607Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue only affected Armv7-A systems. Other operating systems are una…Mozilla · Firefox · CVSS 8.1 · 2024-03-19 | 8.1 | 1.1% | 2024-03-19 |
| CVE-2021-42540Emerson WirelessHART GatewayEmerson · WirelessHART Gateway · CVSS 8 · 2021-10-22 | 8.0 | 1.0% | 2021-10-22 |
| CVE-2025-9900Libtiff: libtiff write-what-whereRedhat · libtiff · CVSS 8.8 · 2025-09-23 | 8.8 | 1.0% | 2025-09-23 |
| CVE-2025-62164VLLM deserialization vulnerability leading to DoS and potential RCEvllm-project · vllm · CVSS 8.8 · 2025-11-21 | 8.8 | 1.0% | 2025-11-21 |
| CVE-2022-41757An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to obtain write access to read-only memory, or obtain…Arm · Valhall Gpu Kernel Driver · CVSS 8.8 · 2022-11-08 | 8.8 | 0.9% | 2022-11-08 |
| CVE-2022-37904Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow…Hewlett Packard Enterprise · Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers… · CVSS 6.6 · 2022-11-03 | 6.6 | 0.9% | 2022-11-03 |
| CVE-2024-36877Micro-Star International Z-series motherboards (Z590, Z490, and Z790) and B-series motherboards (B760, B560, B660, and B460) with firmware 7D25v14, 7D25v17 to 7D25v19, and 7D25v1A…No vendor recorded · CVSS 8.2 · 2024-08-12 | 8.2 | 0.7% | 2024-08-12 |
| CVE-2025-3052An arbitrary write vulnerability in Microsoft signed UEFI firmware from DT Research Inc.DT Research · BiosFlashShell · CVSS 8.2 · 2025-06-10 | 8.2 | 0.7% | 2025-06-10 |
| CVE-2021-36057XMP Toolkit SDK Write-What-Where Condition Could Lead To Local Application Denial Of ServiceAdobe · XMP Toolkit · CVSS 4 · 2021-09-01 | 4.0 | 0.6% | 2021-09-01 |
| CVE-2025-69809A write-what-where condition in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to write arbitrary values to memory, enabling arbitrary code execution via a crafted p…P2r3 · Bareiron · CVSS 9.8 · 2026-03-16 | 9.8 | 0.6% | 2026-03-16 |
| CVE-2022-1523Fuji Electric D300win Write-what-where conditionFuji Electric · D300win · CVSS 6.1 · 2022-10-19 | 6.1 | 0.6% | 2022-10-19 |
| CVE-2018-3971An exploitable arbitrary write vulnerability exists in the 0x2222CC IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the…Talos · Sophos · CVSS 9.3 · 2018-10-25 | 9.3 | 0.5% | 2018-10-25 |
| CVE-2018-16962Webroot SecureAnywhere before 9.0.8.34 on macOS mishandles access to the driver by a process that lacks root privileges.Webroot · Secureanywhere · 2018-09-12 | – | 0.5% | 2018-09-12 |
| CVE-2022-40246Arbitrary write vulnerability in SbPei module leads to arbitrary code execution during PEI phase.AMI · Aptio · CVSS 7.2 · 2022-09-20 | 7.2 | 0.5% | 2022-09-20 |
| CVE-2026-48977OpenSlide: Arbitrary memory write with crafted Ventana BIF fileopenslide · openslide · CVSS 7.7 · 2026-09-17 | 7.7 | 0.5% | 2026-09-17 |
| CVE-2026-92372Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code ExecutionTeamViewer · Full Client · CVSS 8.8 · 2026-10-27 | 8.8 | 0.4% | 2026-10-27 |
| CVE-2022-35408An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver in UsbLegacyControlSmm leads to possible arbitrary code exe…Insyde · Insydeh2o · CVSS 8.2 · 2022-09-22 | 8.2 | 0.4% | 2022-09-22 |
| CVE-2021-1390Cisco IOS XE Software Local Privilege Escalation VulnerabilityCisco · Cisco IOS XE Software · CVSS 5.1 · 2021-03-24 | 5.1 | 0.3% | 2021-03-24 |
| CVE-2018-15376Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Arbitrary Memory Write VulnerabilitiesCisco · Cisco IOS Software · 2018-10-05 | – | 0.3% | 2018-10-05 |
| CVE-2018-15375Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Arbitrary Memory Write VulnerabilitiesCisco · Cisco IOS Software · 2018-10-05 | – | 0.3% | 2018-10-05 |
| CVE-2022-40262The arbitrary write vulnerability in S3Resume2Pei leads to arbitrary code execution during PEI phase.AMI · Aptio · CVSS 8.2 · 2022-09-20 | 8.2 | 0.3% | 2022-09-20 |
| CVE-2026-30121remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability.Remotion · Remotion · CVSS 9.1 · 2026-06-15 | 9.1 | 0.3% | 2026-06-15 |
| CVE-2021-45465A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied data when parsing BMP files. This could res…Siemens · syngo fastView · CVSS 7.8 · 2024-01-04 | 7.8 | 0.3% | 2024-01-04 |
| CVE-2024-45142Substance3D - Stager | Write-what-where Condition (CWE-123)Adobe · Substance3D - Stager · CVSS 7.8 · 2024-10-09 | 7.8 | 0.3% | 2024-10-09 |
| CVE-2021-1520Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Local Privilege Escalation VulnerabilityCisco · Cisco Small Business RV Series Router Firmware · CVSS 6.7 · 2021-05-06 | 6.7 | 0.3% | 2021-05-06 |
| CVE-2024-20741Adobe Substance 3D Paint ICO Parsing Access Violation Write VulnerabilityAdobe · Substance3D - Painter · CVSS 7.8 · 2024-02-15 | 7.8 | 0.3% | 2024-02-15 |
| CVE-2025-14857Semtech LR11xx Memory Write Access Control BypassSemtech · LR1110 · CVSS 5.4 · 2026-04-07 | 5.4 | 0.3% | 2026-04-07 |
| CVE-2024-44067The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have instructions that allow unprivileged attackers to write to arbitrary physic…No vendor recorded · CVSS 8.4 · 2024-08-19 | 8.4 | 0.2% | 2024-08-19 |
| CVE-2026-25634iccDEV memcpy-param-overlap in CIccTagMultiProcessElement::Apply()InternationalColorConsortium · iccDEV · CVSS 7.8 · 2026-02-06 | 7.8 | 0.2% | 2026-02-06 |
| CVE-2025-29943Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentially resulting in the corruption of the sta…AMD · AMD EPYC™ 9004 Series Processors · CVSS 4.6 · 2026-01-16 | 4.6 | 0.2% | 2026-01-16 |
| CVE-2024-47438Substance3D - Painter | Write-what-where Condition (CWE-123)Adobe · Substance3D - Painter · CVSS 5.5 · 2024-11-12 | 5.5 | 0.2% | 2024-11-12 |
| CVE-2024-6563Buffer Overflow Arbitrary WriteRenesas · rcar_gen3_v2.5 · CVSS 7.5 · 2024-07-08 | 7.5 | 0.2% | 2024-07-08 |
| CVE-2025-7403Bluetooth: bt_conn_tx_processor unsafe handlingzephyrproject-rtos · Zephyr · CVSS 7.6 · 2025-09-19 | 7.6 | 0.2% | 2025-09-19 |
| CVE-2026-94146BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-whereBioStar · BIOS Update Utility · CVSS 8.8 · 2026-09-21 | 8.8 | 0.2% | 2026-09-21 |
| CVE-2026-94142BioStar Temperature Monitor Utility IOCTL BS_HWMIO64_W10.sys sub_1105C write-what-whereBioStar · Temperature Monitor Utility · CVSS 8.8 · 2026-09-21 | 8.8 | 0.2% | 2026-09-21 |
| CVE-2026-94129BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-whereBioStar · VALKYRIE AURORA · CVSS 8.8 · 2026-09-21 | 8.8 | 0.2% | 2026-09-21 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.