CWE

Common Weakness Enumeration

A community-developed list of SW & HW weaknesses that can become vulnerabilities
New to CWE? click here!
CWE Most Important Hardware Weaknesses
CWE Top 25 Most Dangerous Weaknesses
Home > CWE List > CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior (4.20)  
ID
  • Home
  • Who We Are User Stories History Documents Videos
  • Basics
    Root Cause Mapping   ►
    Guidance Quick Tips Examples
    How to Contribute Weakness Content FAQs Glossary
  • Top-N Lists   ►
    Top 25 Software Top Hardware Top 10 KEV Weaknesses
    CWE List   ►
    Current Version Reports Visualizations Releases Archive
    Downloads REST API
  • News   ►
    Current News Blog Podcast News Archive
    CWE Board Working Groups & Special Interest Groups Email Lists
    • Search CWE List Search Website

    CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

    Weakness ID: 758
    Vulnerability Mapping: ALLOWED This CWE ID could be used to map to real-world vulnerabilities in limited situations requiring careful review (with careful review of mapping notes)
    Abstraction: Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
    View customized information:
    For users who are interested in more notional aspects of a weakness. Example: educators, technical writers, and project/program managers. For users who are concerned with the practical application and details about the nature of a weakness and how to prevent it from happening. Example: tool developers, security researchers, pen-testers, incident response analysts. For users who are mapping an issue to CWE/CAPEC IDs, i.e., finding the most appropriate CWE for a specific issue (e.g., a CVE record). Example: tool developers, security researchers. For users who wish to see all available information for the CWE/CAPEC entry. For users who want to customize what details are displayed.
    ×

    Edit Custom Filter


    + Description
    The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.
    + Extended Description
    This can lead to resultant weaknesses when the required properties change, such as when the product is ported to a different platform or if an interaction error (CWE-435) occurs.
    + Common Consequences
    Section HelpThis table specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
    Impact Details

    Reduce Maintainability; Unexpected State; Quality Degradation

    		Scope: Other

    + Relationships
    Section Help This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
    + Relevant to the view "Research Concepts" (View-1000)
    Nature Type ID Name
    ChildOf Pillar Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. 710 Improper Adherence to Coding Standards
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 474 Use of Function with Inconsistent Implementations
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 562 Return of Stack Variable Address
    ParentOf Variant Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. 587 Assignment of a Fixed Address to a Pointer
    ParentOf Variant Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. 588 Attempt to Access Child of a Non-structure Pointer
    ParentOf Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 1038 Insecure Automated Optimizations
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1102 Reliance on Machine-Dependent Data Representation
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1103 Use of Platform-Dependent Third Party Components
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1105 Insufficient Encapsulation of Machine-Dependent Functionality
    + Modes Of Introduction
    Section HelpThe different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.
    Phase Note
    Implementation
    + Applicable Platforms
    Section HelpThis listing shows possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.
    Languages

    Class: Not Language-Specific (Undetermined Prevalence)

    + Demonstrative Examples

    Example 1


    This code assumes a particular function will always be found at a particular address. It assigns a pointer to that address and calls the function.

    (bad code)
    Example Language: C 
    int (*pt2Function) (float, char, char)=0x08040000;
    int result2 = (*pt2Function) (12, 'a', 'b');
    // Here we can inject code to execute.

    The same function may not always be found at the same memory address. This could lead to a crash, or an attacker may alter the memory at the expected address, leading to arbitrary code execution.



    Example 2


    The following function returns a stack address.

    (bad code)
    Example Language: C 
    char* getName() {
    char name[STR_MAX];
    fillInName(name);
    return name;
    }


    + Selected Observed Examples

    Note: this is a curated list of examples for users to understand the variety of ways in which this weakness can be introduced. It is not a complete list of all CVEs that are related to this CWE entry.

    Reference Description
    Change in C compiler behavior causes resultant buffer overflows in programs that depend on behaviors that were undefined in the C standard.
    + Weakness Ordinalities
    Ordinality Description
    Indirect
    (where the weakness is a quality issue that might indirectly make it easier to introduce security-relevant weaknesses or make them more difficult to detect)
    Primary
    (where the weakness exists independent of other weaknesses)
    + Detection Methods
    Method Details

    Fuzzing
    Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.

    Effectiveness: High
    + Memberships
    Section HelpThis MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
    Nature Type ID Name
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1001 SFP Secondary Cluster: Use of an Improper API
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1157 SEI CERT C Coding Standard - Guidelines 03. Expressions (EXP)
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1158 SEI CERT C Coding Standard - Guidelines 04. Integers (INT)
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1160 SEI CERT C Coding Standard - Guidelines 06. Arrays (ARR)
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1162 SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM)
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1163 SEI CERT C Coding Standard - Guidelines 09. Input Output (FIO)
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1167 SEI CERT C Coding Standard - Guidelines 12. Error Handling (ERR)
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1170 SEI CERT C Coding Standard - Guidelines 48. Miscellaneous (MSC)
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1306 CISQ Quality Measures - Reliability
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1412 Comprehensive Categorization: Poor Coding Practices
    + Vulnerability Mapping Notes
    Usage ALLOWED-WITH-REVIEW
    (this CWE ID could be used to map to real-world vulnerabilities in limited situations requiring careful review)
    Reason Abstraction

    Rationale

    		This CWE entry is a Class and might have Base-level children that would be more appropriate

    Comments

    		Examine children of this entry to see if there is a better fit
    + Taxonomy Mappings
    Mapped Taxonomy Name Node ID Fit Mapped Node Name
    CERT C Secure Coding ARR32-C CWE More Abstract Ensure size arguments for variable length arrays are in a valid range
    CERT C Secure Coding ERR34-C Imprecise Detect errors when converting a string to a number
    CERT C Secure Coding EXP30-C CWE More Abstract Do not depend on the order of evaluation for side effects
    CERT C Secure Coding EXP33-C CWE More Abstract Do not read uninitialized memory
    CERT C Secure Coding FIO46-C CWE More Abstract Do not access a closed file
    CERT C Secure Coding INT34-C CWE More Abstract Do not shift an expression by a negative number of bits or by greater than or equal to the number of bits that exist in the operand
    CERT C Secure Coding INT36-C CWE More Abstract Converting a pointer to integer or integer to pointer
    CERT C Secure Coding MEM30-C CWE More Abstract Do not access freed memory
    CERT C Secure Coding MSC14-C Do not introduce unnecessary platform dependencies
    CERT C Secure Coding MSC15-C Do not depend on undefined behavior
    CERT C Secure Coding MSC37-C CWE More Abstract Ensure that control never reaches the end of a non-void function
    + Content History
    + Submissions
    Submission Date Submitter Organization
    2009-03-03
    (CWE 1.3, 2009-03-10)     		CWE Content Team MITRE
    + Modifications
    Modification Date Modifier Organization
    2025-12-11
    (CWE 4.19, 2025-12-11)     		CWE Content Team MITRE
    updated Applicable_Platforms, Common_Consequences, Time_of_Introduction
    2024-02-29
    (CWE 4.14, 2024-02-29)     		CWE Content Team MITRE
    updated Demonstrative_Examples
    2023-06-29
    (CWE 4.12, 2023-06-29)     		CWE Content Team MITRE
    updated Mapping_Notes
    2023-04-27
    (CWE 4.11, 2023-04-27)     		CWE Content Team MITRE
    updated Detection_Factors, Relationships
    2023-01-31
    (CWE 4.10, 2023-01-31)     		CWE Content Team MITRE
    updated Description
    2020-08-20
    (CWE 4.2, 2020-08-20)     		CWE Content Team MITRE
    updated Relationships
    2020-02-24
    (CWE 4.0, 2020-02-24)     		CWE Content Team MITRE
    updated Relationships
    2019-01-03
    (CWE 3.2, 2019-01-03)     		CWE Content Team MITRE
    updated Relationships, Weakness_Ordinalities
    2018-03-27
    (CWE 3.1, 2018-03-27)     		CWE Content Team MITRE
    updated Relationships
    2017-11-08
    (CWE 3.0, 2017-11-08)     		CWE Content Team MITRE
    updated Relationships, Taxonomy_Mappings
    2017-01-19
    (CWE 2.10, 2017-01-19)     		CWE Content Team MITRE
    updated Relationships
    2014-07-30
    (CWE 2.8, 2014-07-31)     		CWE Content Team MITRE
    updated Relationships
    2012-05-11
    (CWE 2.2, 2012-05-15)     		CWE Content Team MITRE
    updated Relationships
    2011-06-01
    (CWE 1.13, 2011-06-01)     		CWE Content Team MITRE
    updated Common_Consequences
    Page Last Updated: April 30, 2026
     

    Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.