CWE · MITRE source
CWE-134Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Last updated: 15 October 2026 20:36 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2020-13160 UPD | 9.9 | 9.8 | 0.8055 | 2020-06-09 |
CVE-2024-23113 KEV UPD | 9.9 | 9.8 | 0.6172 | 2024-02-15 |
CVE-2020-3118 KEV UPD | 9.2 | 8.8 | 0.1168 | 2020-02-05 |
CVE-2018-6317 UPD | 8.7 | 9.1 | 0.4368 | 2018-02-02 |
CVE-2018-0175 KEV UPD | 8.7 | 8.0 | 0.0348 | 2018-03-28 |
CVE-2019-1579 KEV UPD | 8.7 | 8.1 | 0.4624 | 2019-07-19 |
CVE-2015-8617 UPD | 8.6 | 9.8 | 0.2281 | 2016-01-19 |
CVE-2023-22374 UPD | 8.6 | 8.5 | 0.7265 | 2023-02-01 |
CVE-2016-4448 UPD | 8.1 | 9.8 | 0.0704 | 2016-06-09 |
CVE-2012-1851 UPD | 8.0 | 0.0 | 0.6562 | 2012-08-15 |
CVE-2017-10685 UPD | 7.9 | 9.8 | 0.0426 | 2017-06-29 |
CVE-2017-16608 UPD | 7.9 | 9.8 | 0.0423 | 2018-01-23 |
CVE-2017-17407 UPD | 7.9 | 9.8 | 0.0386 | 2018-01-23 |
CVE-2018-10388 UPD | 7.9 | 9.8 | 0.0436 | 2019-12-23 |
CVE-2020-27853 UPD | 7.9 | 9.8 | 0.0394 | 2020-10-27 |
CVE-2015-7271 UPD | 7.8 | 9.8 | 0.0273 | 2017-04-10 |
CVE-2017-12588 UPD | 7.8 | 9.8 | 0.0283 | 2017-08-06 |
CVE-2021-42911 UPD | 7.8 | 9.8 | 0.0352 | 2022-03-29 |
CVE-2022-26674 UPD | 7.8 | 9.8 | 0.0276 | 2022-04-22 |
CVE-2017-0898 UPD | 7.7 | 9.1 | 0.0972 | 2017-09-15 |
CVE-2018-10389 UPD | 7.7 | 9.8 | 0.0226 | 2019-12-23 |
CVE-2021-20307 UPD | 7.7 | 9.8 | 0.0194 | 2021-04-05 |
CVE-2021-36161 UPD | 7.7 | 9.8 | 0.0247 | 2021-09-09 |
CVE-2021-41193 UPD | 7.7 | 9.8 | 0.0247 | 2022-03-01 |
CVE-2022-27177 UPD | 7.7 | 9.8 | 0.0226 | 2022-04-01 |