Weakness (CWE)
CWE-123: Write-what-where Condition
Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.
How to prevent it (2 mitigations)
-
Architecture and Design
Use a language that provides appropriate memory abstractions.
-
Operation
Use OS-level preventative functionality integrated after the fact. Not a complete solution.
Source: MITRE CWE-123
14 results · Clear filters · Feed
-
Medium 6.9CVE-2026-25262 Public exploit
Write-what-where Condition in Primary Bootloader
Memory corruption while processing a crafted ELF file in the Primary Bootloader.
-
Medium 5.8
In trusted_mem, there is a possible escalation of privilege due to improper input validation. This could lead to local …
-
Medium 5.4CVE-2025-14857 Public exploit
Semtech LR11xx Memory Write Access Control Bypass
An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An at…
-
Medium 4.6CVE-2025-29943 Public exploit
Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU…
-
Medium 6.8
In V5 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
Medium 5.5
Substance3D - Painter | Write-what-where Condition (CWE-123)
Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerability allows an attacker to write a controlled value at a controlled memory location, which could resul…
-
Medium 6.7
In mms, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation o…
-
Medium 6.7
In mms, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation o…
-
Medium 6.6
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code d…
-
Medium 6.1
Fuji Electric D300win Write-what-where condition
Fuji Electric D300win prior to version 3.7.1.17 is vulnerable to a write-what-where condition, which could allow an attacker to overwrite program memory to manipulate the flow of information.
-
Medium 6.6
Eclipse CycloneDDS Write-what-where Condition
Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML parser.
-
Medium 4.0
XMP Toolkit SDK Write-What-Where Condition Could Lead To Local Application Denial Of Service
XMP Toolkit SDK version 2020.1 (and earlier) is affected by a write-what-where condition vulnerability caused during the application's memory allocation process. This may cause the memory management functions to become mismatched resulting in local applicatio…
-
Medium 6.7
Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Local Privilege Escalation Vulnerability
A vulnerability in the internal message processing of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, local attacker to run arbitrary commands with root privileges on the underlying operating system (OS). This…
-
Medium 5.1
Cisco IOS XE Software Local Privilege Escalation Vulnerability
A vulnerability in one of the diagnostic test CLI commands of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker would need to have valid user credent…