CWEweakness

CWE-1077 Floating Point Comparison with Incorrect Operator

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators that do not account for the possibility of loss of precision.

Common consequences

• Other: Reduce Reliability — This issue can prevent the product from running reliably. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Related

Child of · CWE (2)

  • CWE-480 Use of Incorrect Operator weakness
  • CWE-697 Incorrect Comparison weakness

Referenced by CVE · weakness (7)

  • CVE-2025-60496 A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows… vulnerability
  • CVE-2022-4996 A flaw has been found in mruby 3.1.0. vulnerability
  • CVE-2025-55658 GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_opus_parse_packet_header function… vulnerability
  • CVE-2023-4720 Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV. vulnerability
  • CVE-2023-26590 A floating point exception vulnerability was found in sox, in the lsx_aiffstartwrite function at sox/src/aiff.c:622:58. vulnerability
  • CVE-2023-32627 A floating point exception vulnerability was found in sox, in the read_samples function at sox/src/voc.c:334:18. vulnerability
  • CVE-2022-4293 Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. vulnerability