Common Weakness Enumeration
CWE-123
AllowedWrite-what-where Condition
Abstraction: Base · Status: Draft
Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.
86 vulnerabilities reference this CWE, most recent first.
GHSA-PXCM-W3R6-W362
Vulnerability from github – Published: 2022-12-12 15:30 – Updated: 2022-12-14 21:30
VLAI
Details
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-37904"
],
"database_specific": {
"cwe_ids": [
"CWE-123",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-12T13:15:00Z",
"severity": "HIGH"
},
"details": "Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.",
"id": "GHSA-pxcm-w3r6-w362",
"modified": "2022-12-14T21:30:17Z",
"published": "2022-12-12T15:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37904"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q39Q-7726-RG48
Vulnerability from github – Published: 2022-12-23 00:30 – Updated: 2022-12-30 03:30
VLAI
Details
A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. A specially-crafted bmp file can write to arbitrary out of bounds memory, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2022-38143"
],
"database_specific": {
"cwe_ids": [
"CWE-123",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-22T22:15:00Z",
"severity": "CRITICAL"
},
"details": "A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. A specially-crafted bmp file can write to arbitrary out of bounds memory, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.",
"id": "GHSA-q39q-7726-rg48",
"modified": "2022-12-30T03:30:19Z",
"published": "2022-12-23T00:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38143"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3LET4MEPBSBJZK4EMLEBY4FUXKU5BMN"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202305-33"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1630"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QC8J-WVJF-7JFJ
Vulnerability from github – Published: 2025-09-23 18:30 – Updated: 2026-04-21 00:32
VLAI
Details
A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file.
By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2025-9900"
],
"database_specific": {
"cwe_ids": [
"CWE-123"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-23T17:15:38Z",
"severity": "HIGH"
},
"details": "A flaw was found in Libtiff. This vulnerability is a \"write-what-where\" condition, triggered when the library processes a specially crafted TIFF image file.\n\nBy providing an abnormally large image height value in the file\u0027s metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.",
"id": "GHSA-qc8j-wvjf-7jfj",
"modified": "2026-04-21T00:32:14Z",
"published": "2025-09-23T18:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9900"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:17651"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21994"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23078"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23079"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23080"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0001"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0076"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0077"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0078"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3461"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3462"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:7504"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-9900"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392784"
},
{
"type": "WEB",
"url": "https://github.com/SexyShoelessGodofWar/LibTiff-4.7.0-Write-What-Where?tab=readme-ov-file"
},
{
"type": "WEB",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/704"
},
{
"type": "WEB",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/732"
},
{
"type": "WEB",
"url": "https://libtiff.gitlab.io/libtiff/releases/v4.7.1.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00031.html"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:17675"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:17710"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:17738"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:17739"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:17740"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19113"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19156"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19276"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19906"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19947"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:20956"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:20998"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21060"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21061"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21062"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21407"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21506"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21507"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21508"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/09/26/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W9P5-XQXF-XVX7
Vulnerability from github – Published: 2024-11-04 03:30 – Updated: 2024-11-04 12:32
VLAI
Details
In mms, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09062392; Issue ID: MSV-1621.
Severity
6.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-20118"
],
"database_specific": {
"cwe_ids": [
"CWE-123",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-04T02:15:17Z",
"severity": "MODERATE"
},
"details": "In mms, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09062392; Issue ID: MSV-1621.",
"id": "GHSA-w9p5-xqxf-xvx7",
"modified": "2024-11-04T12:32:56Z",
"published": "2024-11-04T03:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20118"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/November-2024"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X838-QR7R-99R6
Vulnerability from github – Published: 2022-05-17 01:58 – Updated: 2022-05-17 01:58
VLAI
Details
Foxit Reader before 8.3.1 and PhantomPDF before 8.3.1 have an Arbitrary Write vulnerability, which allows remote attackers to execute arbitrary code via a crafted document.
Severity
7.3 (High)
{
"affected": [],
"aliases": [
"CVE-2017-10994"
],
"database_specific": {
"cwe_ids": [
"CWE-123"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-07T16:29:00Z",
"severity": "HIGH"
},
"details": "Foxit Reader before 8.3.1 and PhantomPDF before 8.3.1 have an Arbitrary Write vulnerability, which allows remote attackers to execute arbitrary code via a crafted document.",
"id": "GHSA-x838-qr7r-99r6",
"modified": "2022-05-17T01:58:13Z",
"published": "2022-05-17T01:58:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10994"
},
{
"type": "WEB",
"url": "https://www.foxitsoftware.com/support/security-bulletins.php"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99499"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039113"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XJJJ-2993-4G39
Vulnerability from github – Published: 2026-04-07 21:32 – Updated: 2026-04-07 21:32
VLAI
Details
An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An attacker with physical access to the SPI interface can overwrite stack memory to hijack program control flow and achieve limited arbitrary code execution. However, the impact is limited to the active attack session: the device's secure boot mechanism prevents persistent firmware modification, the crypto engine isolates cryptographic keys from direct firmware access, and all modifications are lost upon device reboot or loss of physical access.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-14857"
],
"database_specific": {
"cwe_ids": [
"CWE-123"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-07T20:16:21Z",
"severity": "MODERATE"
},
"details": "An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An attacker with physical access to the SPI interface can overwrite stack memory to hijack program control flow and achieve limited arbitrary code execution. However, the impact is limited to the active attack session: the device\u0027s secure boot mechanism prevents persistent firmware modification, the crypto engine isolates cryptographic keys from direct firmware access, and all modifications are lost upon device reboot or loss of physical access.",
"id": "GHSA-xjjj-2993-4g39",
"modified": "2026-04-07T21:32:39Z",
"published": "2026-04-07T21:32:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14857"
},
{
"type": "WEB",
"url": "https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Architecture and Design
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
Mitigation
Operation
Use OS-level preventative functionality integrated after the fact. Not a complete solution.
No CAPEC attack patterns related to this CWE.