CWEweakness

CWE-628 Function Call with Incorrectly Specified Arguments

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product calls a function, procedure, or routine with arguments that are not correctly specified.

Common consequences

• Other, Access Control: Quality Degradation, Gain Privileges or Assume Identity, Unexpected State, Varies by Context — This weakness can cause unintended, always-incorrect behavior. It can lead to additional weaknesses such as allowing an attacker to gain unintended access to system resources.

Potential mitigations

• [Build and Compilation] Once found, these issues are easy to fix. Use code inspection tools and relevant compiler features to identify potential violations. Pay special attention to code that is not likely to be exercised heavily during QA. • [Architecture and Design] Make sure your API's are stable before you use them in production code.

Detection methods

• Other: Since these bugs typically introduce incorrect behavior that is obvious to users, they are found quickly, unless they occur in rarely-tested code paths. Managing the correct number of arguments can be made more difficult in cases where format strings are used, or when variable numbers of arguments are supported.

Observed examples

• CVE-2006-7049: The method calls the functions with the wrong argument order, which allows remote attackers to bypass intended access restrictions.

Related

Observed example · CVE (1)

  • CVE-2006-7049 The Method method in WikkaWiki (Wikka Wiki) before 1.1.6.2 calls the strstr and strrpos functions with the wrong argument order, which… vulnerability

Child of · CWE (1)

  • CWE-573 Improper Following of Specification by Caller weakness

Referenced by CVE · weakness (10)

  • CVE-2026-68907 libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. vulnerability
  • CVE-2026-104430 Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH… vulnerability
  • CVE-2026-94636 Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation… vulnerability
  • CVE-2026-19349 Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication… vulnerability
  • CVE-2026-43133 In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit… vulnerability
  • CVE-2026-25634 iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. vulnerability
  • CVE-2026-21503 iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. vulnerability
  • CVE-2025-0325 A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to… vulnerability
  • CVE-2019-14844 A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending… vulnerability
  • CVE-2019-7303 A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a… vulnerability

Referenced by CWE · child of (5)

  • CWE-683 Function Call With Incorrect Order of Arguments weakness
  • CWE-685 Function Call With Incorrect Number of Arguments weakness
  • CWE-686 Function Call With Incorrect Argument Type weakness
  • CWE-687 Function Call With Incorrectly Specified Argument Value weakness
  • CWE-688 Function Call With Incorrect Variable or Reference as Argument weakness

Referenced by CWE · has member (1)

Referenced by OWASP · mapped cwe (1)