CWE-134Use of Externally-Controlled Format String

Abstraction: Base · CVEs in our corpus: 403

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Last updated: 21 August 2026 14:15 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 2 mapping(s) from 1 framework(s): CAPEC 2 (full)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
SA-11 Developer Testing and Evaluation
ID.RA-01
SI-10 Information Input Validation

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2020-13160`	9.9	9.8	0.8055	2020-06-09
`CVE-2024-23113` KEV	9.9	9.8	0.6172	2024-02-15
`CVE-2020-3118` KEV	9.2	8.8	0.1168	2020-02-05
`CVE-2018-6317`	8.7	9.1	0.4368	2018-02-02
`CVE-2018-0175` KEV	8.7	8.0	0.0350	2018-03-28
`CVE-2019-1579` KEV	8.7	8.1	0.4596	2019-07-19
`CVE-2015-8617`	8.6	9.8	0.2281	2016-01-19
`CVE-2023-22374`	8.6	8.5	0.7265	2023-02-01
`CVE-2016-4448`	8.1	9.8	0.0704	2016-06-09
`CVE-2012-1851`	8.0	0.0	0.6564	2012-08-15
`CVE-2017-10685`	7.9	9.8	0.0426	2017-06-29
`CVE-2017-16608`	7.9	9.8	0.0423	2018-01-23
`CVE-2017-17407`	7.9	9.8	0.0386	2018-01-23
`CVE-2018-10388`	7.9	9.8	0.0436	2019-12-23
`CVE-2020-27853`	7.9	9.8	0.0394	2020-10-27
`CVE-2015-7271`	7.8	9.8	0.0273	2017-04-10
`CVE-2017-12588`	7.8	9.8	0.0283	2017-08-06
`CVE-2021-42911`	7.8	9.8	0.0352	2022-03-29
`CVE-2017-0898`	7.7	9.1	0.0972	2017-09-15
`CVE-2018-10389`	7.7	9.8	0.0226	2019-12-23
`CVE-2021-20307`	7.7	9.8	0.0194	2021-04-05
`CVE-2021-36161`	7.7	9.8	0.0247	2021-09-09
`CVE-2021-41193`	7.7	9.8	0.0247	2022-03-01
`CVE-2022-27177`	7.7	9.8	0.0227	2022-04-01
`CVE-2022-26674`	7.7	9.8	0.0266	2022-04-22