# CWE-123.

Every Advisory and CVE whose sources give the weakness CWE-123, newest first.

## Records, newest first

- [Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution](https://agentprime.io/advisories/CVE-2026-92372.md)
  `CVE-2026-92372` · CVE record: TeamViewer Full Client · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-123
- [Write-what-where Condition in Primary Bootloader](https://agentprime.io/advisories/CVE-2026-25262.md)
  `CVE-2026-25262` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-123
- [BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where](https://agentprime.io/advisories/CVE-2026-94146.md)
  `CVE-2026-94146` · CVE record: BioStar BIOS Update Utility · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption, CWE-123
- [BioStar Temperature Monitor Utility IOCTL BS_HWMIO64_W10.sys sub_1105C write-what-where](https://agentprime.io/advisories/CVE-2026-94142.md)
  `CVE-2026-94142` · CVE record: BioStar Temperature Monitor Utility · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption, CWE-123
- [BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-where](https://agentprime.io/advisories/CVE-2026-94129.md)
  `CVE-2026-94129` · CVE record: BioStar VALKYRIE AURORA · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption, CWE-123
- [BioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-where](https://agentprime.io/advisories/CVE-2026-94128.md)
  `CVE-2026-94128` · CVE record: BioStar VIVID LED DJ · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption, CWE-123
- [OpenSlide: Arbitrary memory write with crafted Ventana BIF file](https://agentprime.io/advisories/CVE-2026-48977.md)
  `CVE-2026-48977` · CVE record: openslide openslide · CVSS 7.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-123, CWE-823, CWE-1284
- [An untrusted Pointer Dereference can be exploited to escalate privileges by an unprivileged user on Windows](https://agentprime.io/advisories/CVE-2026-81579.md)
  `CVE-2026-81579` · CVE record: wibu-systems-ag wibukey · CVSS 8.8 High · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-123
- [In trusted_mem, there is a possible escalation of privilege due to improper input validation.](https://agentprime.io/advisories/CVE-2026-20469.md)
  `CVE-2026-20469` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 5.8 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-123
- [NVIDIA TensorRT-LLM: NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a…](https://agentprime.io/advisories/CVE-2026-47473.md)
  `CVE-2026-47473` · CVE record: NVIDIA TensorRT-LLM · CVSS 7.4 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-123
- [Arbitrary file overwrite via the KTLS receive path](https://agentprime.io/advisories/CVE-2026-45257.md)
  `CVE-2026-45257` · CVE record: FreeBSD FreeBSD · CVSS 7.8 High · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-123
- [Remotion: arbitrary file write vulnerability](https://agentprime.io/advisories/GHSA-g6pc-6676-c23j.md)
  `GHSA-g6pc-6676-c23j`, `CVE-2026-30121` · npm `remotion`: affected `<4.0.410`, fixed in `4.0.410` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: CWE-123
- [net: gro: don't merge zcopy skbs](https://agentprime.io/advisories/CVE-2026-46323.md)
  `CVE-2026-46323` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption, CWE-123
- [net: skbuff: preserve shared-frag marker during coalescing](https://agentprime.io/advisories/CVE-2026-46300.md)
  `CVE-2026-46300` · CVE record: Linux Linux · CVSS 7.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.16 · Not analysed yet · Published 23 May 2026 · Tags: CWE-123, CWE-456
- [rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present](https://agentprime.io/advisories/CVE-2026-43500.md)
  `CVE-2026-43500` · CVE record: Linux Linux · CVSS 7.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.94 · Not analysed yet · Published 11 May 2026 · Tags: Memory corruption, CWE-123
- [xfrm: esp: avoid in-place decrypt on shared skb frags](https://agentprime.io/advisories/CVE-2026-43284.md)
  `CVE-2026-43284` · CVE record: Linux Linux · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.94 · Not analysed yet · Published 8 May 2026 · Tags: CWE-123
- [Local privilege escalation due to improper input validation.](https://agentprime.io/advisories/CVE-2026-41952.md)
  `CVE-2026-41952` · CVE record: Acronis Acronis DeviceLock DLP and 1 more · CVSS 7.8 High · Not analysed yet · Published 29 Apr 2026 · Tags: CWE-123
- [Semtech LR11xx Memory Write Access Control Bypass](https://agentprime.io/advisories/CVE-2025-14857.md)
  `CVE-2025-14857` · CVE record: Semtech LR1110 and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-123
- [A write-what-where condition in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to write arbitrary values to memory, enabling arbitrary code execution via a crafted packet.](https://agentprime.io/advisories/CVE-2025-69809.md)
  `CVE-2025-69809` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-123
- [iccDEV memcpy-param-overlap in CIccTagMultiProcessElement::Apply()](https://agentprime.io/advisories/CVE-2026-25634.md)
  `CVE-2026-25634` · CVE record: InternationalColorConsortium iccDEV · CVSS 7.8 High · Not analysed yet · Published 6 Feb 2026 · Tags: Memory corruption, CWE-123, CWE-628, CWE-682
- [Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentially resulting in the corruption of the stack pointer inside an…](https://agentprime.io/advisories/CVE-2025-29943.md)
  `CVE-2025-29943` · CVE record: AMD AMD EPYC™ 9004 Series Processors and 4 more · CVSS 4.6 Medium · Not analysed yet · Published 16 Jan 2026 · Tags: CWE-123
- [vLLM introduced enhanced protection for CVE-2025-62164](https://agentprime.io/advisories/GHSA-mcmc-2m55-j8jj.md)
  `GHSA-mcmc-2m55-j8jj`, `CVE-2026-56340`, `PYSEC-2026-250` · PyPI `vllm`: affected `>=0.10.2, <0.13.0`, fixed in `0.13.0` · CVSS 8.7 High · Not analysed yet · Published 8 Jan 2026 · Tags: Insecure deserialization, Memory corruption, CWE-20, CWE-123
- [vLLM deserialization vulnerability leading to DoS and potential RCE](https://agentprime.io/advisories/GHSA-mrw7-hf4f-83pf.md)
  `GHSA-mrw7-hf4f-83pf`, `CVE-2025-62164`, `PYSEC-2026-2018` · PyPI `vllm`: affected `>=0.10.2, <0.11.1`, fixed in `0.11.1` · CVSS 8.8 High · Not analysed yet · Published 20 Nov 2025 · Tags: Insecure deserialization, Memory corruption, CWE-20, CWE-123
- [KubeVirt Vulnerable to Arbitrary Host File Read and Write](https://agentprime.io/advisories/GHSA-46xp-26xh-hpqh.md)
  `GHSA-46xp-26xh-hpqh`, `CVE-2025-64324`, `GO-2025-4110` · Go `kubevirt.io/kubevirt`: affected `<1.6.1 || >=1.7.0-alpha.0, <1.7.0-rc.0`, fixed in `1.6.1`, `1.7.0-rc.0` · CVSS 8.5 High · Not analysed yet · Published 7 Nov 2025 · Tags: Information disclosure, Broken access control, CWE-123
- [Libtiff: libtiff write-what-where](https://agentprime.io/advisories/CVE-2025-9900.md)
  `CVE-2025-9900` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2025 · Tags: CWE-123
- [Bluetooth: bt_conn_tx_processor unsafe handling](https://agentprime.io/advisories/CVE-2025-7403.md)
  `CVE-2025-7403` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.6 High · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-123
- [Legacy Serial Redirection SMRAM Vulnerabilities](https://agentprime.io/advisories/CVE-2025-33045.md)
  `CVE-2025-33045` · CVE record: AMI AptioV · CVSS 8.2 High · Not analysed yet · Published 9 Sept 2025 · Tags: Information disclosure, CWE-123
- [ImageMagick has a Format String Bug in InterpretImageFilename leads to arbitrary code execution](https://agentprime.io/advisories/GHSA-9ccg-6pjw-x645.md)
  `GHSA-9ccg-6pjw-x645`, `CVE-2025-55298` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.8.1`, fixed in `14.8.1` · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2025 · Tags: Memory corruption, CWE-123
- [VMware ESXi contains an arbitrary write vulnerability.](https://agentprime.io/advisories/CVE-2025-22225.md)
  `CVE-2025-22225` · CVE record: VMware ESXi and 3 more · CVSS 8.2 High · Critical (KEV) · In CISA KEV, ransomware · Not analysed yet · Published 4 Mar 2025 · Tags: CWE-123
- [In V5 DA, there is a possible out of bounds write due to a missing bounds check.](https://agentprime.io/advisories/CVE-2024-20141.md)
  `CVE-2024-20141` · CVE record: MediaTek, Inc. MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6873, MT6877, MT6885, MT6893, MT8167, MT8167S, MT8175, MT8185, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8395, MT8666, MT8667, MT8673, MT8675, MT8678, MT8765, MT8766, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8795T, MT8797, MT8798, MT8893 · CVSS 6.8 Medium · Not analysed yet · Published 3 Feb 2025 · Tags: CWE-123
- [Substance3D - Painter | Write-what-where Condition (CWE-123)](https://agentprime.io/advisories/CVE-2024-47438.md)
  `CVE-2024-47438` · CVE record: Adobe Substance3D - Painter · CVSS 5.5 Medium · Not analysed yet · Published 12 Nov 2024 · Tags: CWE-123
- [In mms, there is a possible out of bounds write due to an incorrect bounds check.](https://agentprime.io/advisories/CVE-2024-20119.md)
  `CVE-2024-20119` · CVE record: MediaTek, Inc. MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6883, MT6885, MT6889, MT6893, MT8676 · CVSS 6.7 Medium · Not analysed yet · Published 4 Nov 2024 · Tags: CWE-123
- [In mms, there is a possible out of bounds write due to an incorrect bounds check.](https://agentprime.io/advisories/CVE-2024-20118.md)
  `CVE-2024-20118` · CVE record: MediaTek, Inc. MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6883, MT6885, MT6889, MT6893, MT8676, MT8792 · CVSS 6.7 Medium · Not analysed yet · Published 4 Nov 2024 · Tags: CWE-123
- [Substance3D - Stager | Write-what-where Condition (CWE-123)](https://agentprime.io/advisories/CVE-2024-45142.md)
  `CVE-2024-45142` · CVE record: Adobe Substance3D - Stager · CVSS 7.8 High · Not analysed yet · Published 9 Oct 2024 · Tags: CWE-123
- [The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have instructions that allow unprivileged attackers to write to arbitrary physical memory locations,…](https://agentprime.io/advisories/CVE-2024-44067.md)
  `CVE-2024-44067` · CVE record · CVSS 8.4 High · Not analysed yet · Published 19 Aug 2024 · Tags: Memory corruption, CWE-123
- [llama.cpp allows write-what-where in rpc_server::set_tensor](https://agentprime.io/advisories/CVE-2024-42479.md)
  `CVE-2024-42479` · CVE record: ggerganov llama.cpp · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2024 · Tags: CWE-123
- [Micro-Star International Z-series motherboards (Z590, Z490, and Z790) and B-series motherboards (B760, B560, B660, and B460) with firmware 7D25v14, 7D25v17 to 7D25v19, and 7D25v1A to 7D25v1H was disc…](https://agentprime.io/advisories/CVE-2024-36877.md)
  `CVE-2024-36877` · CVE record · CVSS 8.2 High · Not analysed yet · Published 12 Aug 2024 · Tags: CWE-123
- [Buffer Overflow Arbitrary Write](https://agentprime.io/advisories/CVE-2024-6563.md)
  `CVE-2024-6563` · CVE record: Renesas rcar_gen3_v2.5 · CVSS 7.5 High · Not analysed yet · Published 8 Jul 2024 · Tags: Memory corruption, CWE-123
- [Mozilla Firefox: Return registers were overwritten which could have allowed an attacker to execute…](https://agentprime.io/advisories/CVE-2024-2607.md)
  `CVE-2024-2607` · CVE record: Mozilla Firefox and 2 more · CVSS 8.1 High · Not analysed yet · Published 19 Mar 2024 · Tags: CWE-123
- [Adobe Substance 3D Paint ICO Parsing Access Violation Write Vulnerability](https://agentprime.io/advisories/CVE-2024-20741.md)
  `CVE-2024-20741` · CVE record: Adobe Substance3D - Painter · CVSS 7.8 High · Not analysed yet · Published 15 Feb 2024 · Tags: CWE-123
- [A vulnerability has been identified in syngo fastView (All versions).](https://agentprime.io/advisories/CVE-2021-45465.md)
  `CVE-2021-45465` · CVE record: Siemens syngo fastView · CVSS 7.8 High · Not analysed yet · Published 4 Jan 2024 · Tags: CWE-123
- [OpenImageIO: A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0…](https://agentprime.io/advisories/CVE-2022-38143.md)
  `CVE-2022-38143` · CVE record: OpenImageIO Project OpenImageIO · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Dec 2022 · Tags: CWE-123
- [An issue was discovered in the Arm Mali GPU Kernel Driver.](https://agentprime.io/advisories/CVE-2022-41757.md)
  `CVE-2022-41757` · CVE record · CVSS 8.8 High · Not analysed yet · Published 8 Nov 2022 · Tags: CWE-123
- [Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence.](https://agentprime.io/advisories/CVE-2022-37904.md)
  `CVE-2022-37904` · CVE record: Hewlett Packard Enterprise Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central · CVSS 6.6 Medium · Not analysed yet · Published 3 Nov 2022 · Tags: CWE-123
- [Fuji Electric D300win Write-what-where condition](https://agentprime.io/advisories/CVE-2022-1523.md)
  `CVE-2022-1523` · CVE record: Fuji Electric D300win · CVSS 6.1 Medium · Not analysed yet · Published 19 Oct 2022 · Tags: CWE-123
- [An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.](https://agentprime.io/advisories/CVE-2022-35408.md)
  `CVE-2022-35408` · CVE record · CVSS 8.2 High · Not analysed yet · Published 22 Sept 2022 · Tags: CWE-123
- [The arbitrary write vulnerability in S3Resume2Pei leads to arbitrary code execution during PEI phase.](https://agentprime.io/advisories/CVE-2022-40262.md)
  `CVE-2022-40262` · CVE record: AMI Aptio · CVSS 8.2 High · Not analysed yet · Published 20 Sept 2022 · Tags: CWE-123
- [Arbitrary write vulnerability in SbPei module leads to arbitrary code execution during PEI phase.](https://agentprime.io/advisories/CVE-2022-40246.md)
  `CVE-2022-40246` · CVE record: AMI Aptio · CVSS 7.2 High · Not analysed yet · Published 20 Sept 2022 · Tags: CWE-123
- [Eclipse CycloneDDS Write-what-where Condition](https://agentprime.io/advisories/CVE-2021-38441.md)
  `CVE-2021-38441` · CVE record: Eclipse CycloneDDS · CVSS 6.6 Medium · Not analysed yet · Published 5 May 2022 · Tags: CWE-123
- [Emerson WirelessHART Gateway](https://agentprime.io/advisories/CVE-2021-42540.md)
  `CVE-2021-42540` · CVE record: Emerson WirelessHART Gateway · CVSS 8.0 High · Not analysed yet · Published 22 Oct 2021 · Tags: CWE-123
- [AUVESY Versiondog](https://agentprime.io/advisories/CVE-2021-38449.md)
  `CVE-2021-38449` · CVE record: AUVESY Versiondog · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2021 · Tags: CWE-123
- [XMP Toolkit SDK Write-What-Where Condition Could Lead To Local Application Denial Of Service](https://agentprime.io/advisories/CVE-2021-36057.md)
  `CVE-2021-36057` · CVE record: Adobe XMP Toolkit · CVSS 4.0 Medium · Not analysed yet · Published 1 Sept 2021 · Tags: CWE-123
- [Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2021-1520.md)
  `CVE-2021-1520` · CVE record: Cisco Cisco Small Business RV Series Router Firmware · CVSS 6.7 Medium · Not analysed yet · Published 6 May 2021 · Tags: CWE-123
- [Cisco IOS XE Software Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2021-1390.md)
  `CVE-2021-1390` · CVE record: Cisco Cisco IOS XE Software · CVSS 5.1 Medium · Not analysed yet · Published 24 Mar 2021 · Tags: CWE-123
- [EcoStruxure™ Control Expert (all versions) and Unity Pro…: A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert…](https://agentprime.io/advisories/CVE-2020-7560.md)
  `CVE-2020-7560` · CVE record: EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Expert) (all versions) · No CVSS score · Not analysed yet · Published 11 Dec 2020 · Tags: CWE-123
- [Delta Electronics TPEditor Versions 1.97 and prior.](https://agentprime.io/advisories/CVE-2020-16225.md)
  `CVE-2020-16225` · CVE record: Delta Electronics TPEditor · No CVSS score · Not analysed yet · Published 6 Aug 2020 · Tags: CWE-123
- [PAN-OS: Panorama External control of file vulnerability leads to privilege escalation](https://agentprime.io/advisories/CVE-2020-2001.md)
  `CVE-2020-2001` · CVE record: Palo Alto Networks PAN-OS · CVSS 8.1 High · Not analysed yet · Published 13 May 2020 · Tags: CWE-123
- [Honeywell Experion PKS: An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell…](https://agentprime.io/advisories/CVE-2014-5435.md)
  `CVE-2014-5435` · CVE record: Honeywell Experion PKS · No CVSS score · Not analysed yet · Published 8 Apr 2019 · Tags: CWE-123
- [Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Arbitrary Memory Write Vulnerabilities](https://agentprime.io/advisories/CVE-2018-15376.md)
  `CVE-2018-15376` · CVE record: Cisco Cisco IOS Software · No CVSS score · Not analysed yet · Published 5 Oct 2018 · Tags: CWE-123
- [Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Arbitrary Memory Write Vulnerabilities](https://agentprime.io/advisories/CVE-2018-15375.md)
  `CVE-2018-15375` · CVE record: Cisco Cisco IOS Software · No CVSS score · Not analysed yet · Published 5 Oct 2018 · Tags: CWE-123

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-123>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-123/>. Everything for agents: <https://agentprime.io/llms.txt>.