Weakness (CWE)
CWE-123: Write-what-where Condition
Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.
How to prevent it (2 mitigations)
-
Architecture and Design
Use a language that provides appropriate memory abstractions.
-
Operation
Use OS-level preventative functionality integrated after the fact. Not a complete solution.
Source: MITRE CWE-123
60 results · Feed
-
High 8.4
Write-what-where condition in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor m…
-
High 8.8
Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution
An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. Th…
-
Medium 6.9CVE-2026-25262 Public exploit
Write-what-where Condition in Primary Bootloader
Memory corruption while processing a crafted ELF file in the Primary Bootloader.
-
High 8.8
BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where
A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition…
-
High 8.8
BioStar Temperature Monitor Utility IOCTL BS_HWMIO64_W10.sys sub_1105C write-what-where
A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. Affected by this vulnerability is the function sub_1105C of the file BS_HWMIO64_W10.sys of the component IOCTL Handler. Such manipulation of the argument Physical…
-
High 8.8CVE-2026-94129 Public exploit
BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-where
A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. This vulnerability affects the function sub_1105C of the file BS_RVSIO64.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress results in write-what-where c…
-
High 8.8CVE-2026-94128 Public exploit
BioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-where
A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects the function sub_1105C of the file BS_LED64.sys of the component IOCTL Handler. The manipulation of the argument AssociatedIrp leads to write-what-where condition. …
-
High 7.7
OpenSlide: Arbitrary memory write with crafted Ventana BIF file
OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts…
-
High 8.8
An untrusted Pointer Dereference can be exploited to escalate privileges by an unprivileged user on Windows
In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to exec…
-
Medium 5.8
In trusted_mem, there is a possible escalation of privilege due to improper input validation. This could lead to local …
-
High 7.4
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a write-what-where condition. A successful e…
-
High 7.8
Arbitrary file overwrite via the KTLS receive path
The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile(2), which can reference file-backed memory directly th…
-
Critical 9.1
Remotion: arbitrary file write vulnerability
remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability.
-
High 7.8
net: gro: don't merge zcopy skbs
In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS…
-
High 7.8
net: skbuff: preserve shared-frag marker during coalescing
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain t…
KEV Oct 28, 2026 -
High 7.8
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to …
-
High 8.8
xfrm: esp: avoid in-place decrypt on shared skb frags
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter()…
-
High 7.8
Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DL…
-
Medium 5.4CVE-2025-14857 Public exploit
Semtech LR11xx Memory Write Access Control Bypass
An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An at…
-
Critical 9.8
A write-what-where condition in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to write arbitrary values …
-
High 7.8
iccDEV memcpy-param-overlap in CIccTagMultiProcessElement::Apply()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to 2.3.1.4, SrcPixel and DestPixel stack buffers overlap in CIccTagMultiProcessElement::Apply() int IccTagMPE.cp…
-
Medium 4.6CVE-2025-29943 Public exploit
Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU…
-
High 8.8
VLLM deserialization vulnerability leading to DoS and potential RCE
vLLM is an inference and serving engine for large language models (LLMs). From versions 0.10.2 to before 0.11.1, a memory corruption vulnerability could lead to a crash (denial-of-service) and potentially remote code execution (RCE), exists in the Completions…
-
High 8.5
KubeVirt Vulnerable to Arbitrary Host File Read and Write
KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementation of this feature…
-
High 8.8
Libtiff: libtiff write-what-where
A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the …
-
High 7.6
Bluetooth: bt_conn_tx_processor unsafe handling
Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption.
-
High 8.2
Legacy Serial Redirection SMRAM Vulnerabilities
APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an Unauthorized Actor” through local access. The successful exploitation of these vulnerabilities can lead to …
-
High 7.5
ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed…
-
High 8.2CVE-2025-22225 Exploited · Ransomware
VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may tri…
KEV Mar 4, 2025 -
Medium 6.8
In V5 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
Medium 5.5
Substance3D - Painter | Write-what-where Condition (CWE-123)
Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerability allows an attacker to write a controlled value at a controlled memory location, which could resul…
-
Medium 6.7
In mms, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation o…
-
Medium 6.7
In mms, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation o…
-
High 7.8
Substance3D - Stager | Write-what-where Condition (CWE-123)
Substance3D - Stager versions 3.0.3 and earlier are affected by a Write-what-where Condition vulnerability that could allow an attacker to execute arbitrary code in the context of the current user. This vulnerability allows an attacker to write a controlled v…
-
High 8.4
The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have instructions th…
-
Critical 10.0
llama.cpp allows write-what-where in rpc_server::set_tensor
llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause arbitrary address writing. This vulnerability is fixed in b3561.
-
High 8.2CVE-2024-36877 Public exploit
Micro-Star International Z-series motherboards (Z590, Z490, and Z790) and B-series motherboards (B760, B560, B660, and …
-
High 7.5
Buffer Overflow Arbitrary Write
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. This vulnerability is associated with program files https://github.Com/renesas-rcar/arm-trusted-firmware/blob/…
-
High 8.1
Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue on…
-
High 7.8
Adobe Substance 3D Paint ICO Parsing Access Violation Write Vulnerability
Substance3D - Painter versions 9.1.1 and earlier are affected by a Write-what-where Condition vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…