CWE-618: Exposed Unsafe ActiveX Method
An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that are outside of the browser's security model (e.g. the zone or domain).
Last updated
Overview
ActiveX controls can exercise far greater control over the operating system than typical Java or javascript. Exposed methods can be subject to various vulnerabilities, depending on the implemented behaviors of those methods, and whether input validation is performed on the provided arguments. If there is no integrity checking or origin validation, this method could be invoked by attackers.
Real-world CVEs
1 recorded CVEs are caused by CWE-618 (Exposed Unsafe ActiveX Method). The highest-severity and most recent are shown first. 0 new CWE-618 CVEs have been recorded so far in 2026 (1 in 2025).
Common consequences
What can happen when CWE-618 is exploited.
Other
Affects: Other
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Technologies
How to prevent it
Practical mitigations for CWE-618, grouped by where in the lifecycle they apply.
If you must expose a method, make sure to perform input validation on all arguments, and protect against all possible vulnerabilities.
Use code signing, although this does not protect against any weaknesses that are already in the control.
Where possible, avoid marking the control as safe for scripting.
How to detect it
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2007-1120 — download a file to arbitrary folders.
- CVE-2006-6838 — control downloads and executes a url in a parameter
- CVE-2007-0321 — resultant buffer overflow
Frequently asked questions
Common questions about CWE-618.
- What is CWE-618?
- An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that are outside of the browser's security model (e.g. the zone or domain).
- What CVEs are caused by CWE-618?
- 1 recorded CVEs are attributed to CWE-618, including CVE-2025-0118.
- How do you prevent CWE-618?
- If you must expose a method, make sure to perform input validation on all arguments, and protect against all possible vulnerabilities.
- How is CWE-618 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-618?
- Exploiting CWE-618 can lead to: Other.
- Is CWE-618 actively exploited?
- 1 recorded CVEs are caused by CWE-618; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-618) (opens in a new tab)
- CWE-618 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-618
Get alerted the moment a new CWE-618 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.