Skip to content
Log inStart free trial

CWE-123: Write-what-where Condition

BaseLikelihood of exploit: High

Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.

Consequences

  • Integrity, Confidentiality, Availability, Access Control: Modify Memory, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, DoS: Crash, Exit, or Restart, Bypass Protection Mechanism
  • Integrity, Availability: DoS: Crash, Exit, or Restart, Modify Memory
  • Access Control, Other: Bypass Protection Mechanism, Other

How to prevent it

  • Architecture and Design: Use a language that provides appropriate memory abstractions.
  • Operation: Use OS-level preventative functionality integrated after the fact. Not a complete solution.

Recent advisories

  • CVE-2026-46300 — net: skbuff: preserve shared-frag marker during coalescing
  • GHSA-mcmc-2m55-j8jj — vLLM introduced enhanced protection for CVE-2025-62164
  • GHSA-mrw7-hf4f-83pf — vLLM deserialization vulnerability leading to DoS and potential RCE
  • GHSA-9ccg-6pjw-x645 — ImageMagick has a Format String Bug in InterpretImageFilename leads to arbitrary code execution
  • CVE-2025-22225 — VMware ESXi contains an arbitrary write vulnerability.

All advisories for CWE-123

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor