CWEweakness
CWE-475 Undefined Behavior for Input to API
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The behavior of this function is undefined unless its control parameter is set to a specific value.
Common consequences
• Other: Quality Degradation, Varies by Context
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Related
Child of · CWE (1)
- CWE-573 Improper Following of Specification by Caller weakness
Referenced by CVE · weakness (17)
- CVE-2026-73797 A security vulnerability in HPE NonStop TSQLFIL may cause address space corruption when a specific API is called. vulnerability
- CVE-2026-19311 Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read,… vulnerability
- CVE-2026-42009 A flaw was found in gnutls. vulnerability
- CVE-2026-8391 Other issue in the JavaScript Engine component. vulnerability
- CVE-2026-34379 OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture… vulnerability
- CVE-2026-21690 iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color… vulnerability
- CVE-2025-47865 A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote… vulnerability
- CVE-2025-47866 An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload… vulnerability
- CVE-2024-10569 A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. vulnerability
- CVE-2024-3099 A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. vulnerability
- CVE-2024-20380 A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition… vulnerability
- CVE-2023-52533 In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. vulnerability
- CVE-2023-4874 Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12 vulnerability
- CVE-2023-4875 Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12 vulnerability
- CVE-2023-2253 A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of… vulnerability
- CVE-2022-29207 TensorFlow is an open source platform for machine learning. vulnerability
- CVE-2020-7925 Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to… vulnerability