CWE-563: Assignment to Variable without Use
The variable's value is assigned but never used, making it a dead store.
View on MITREExtended Description
After the assignment, the variable is either assigned another value or goes out of scope. It is likely that the variable is simply vestigial, but it is also possible that the unused variable points out a bug.
Technical Details
- Structure
- Simple
Applicable To
Security Consequences
Scope
Impact
This weakness could be an indication of a bug in the program or a deprecated variable that was not removed and is an indication of poor quality. This could lead to further bugs and the introduction of weaknesses.
Mitigation Strategies
Phase
Description
Remove unused variables from the code.
Detection Methods
No detection method information available for this CWE.
Code Examples & CVEs
Demonstrative Examples
The following code excerpt assigns to the variable r and then overwrites the value without using it.
CWE Relationships
No relationship information available for this CWE.
Frequently Asked Questions
What is CWE-563: Assignment to Variable without Use?+
CWE-563: Assignment to Variable without Use is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The variable's value is assigned but never used, making it a dead store. After the assignment, the variable is either assigned another value or goes out of scope. It is likely that the variable is simply vestigial, but it is also possible that the unused variable points out a bug.
What are the security consequences of Assignment to Variable without Use?+
If exploited, CWE-563 (Assignment to Variable without Use) it can compromise Other, leading to outcomes such as Quality Degradation and Varies by Context.
How do you prevent or mitigate Assignment to Variable without Use?+
Recommended mitigations for CWE-563 include: Remove unused variables from the code.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-563 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.