The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.
View on MITREThis can lead to resultant weaknesses when the required properties change, such as when the product is ported to a different platform or if an interaction error (CWE-435) occurs.
No mitigation information available for this CWE.
No detection method information available for this CWE.
This code assumes a particular function will always be found at a particular address. It assigns a pointer to that address and calls the function.
The same function may not always be found at the same memory address. This could lead to a crash, or an attacker may alter the memory at the expected address, leading to arbitrary code execution.
The following function returns a stack address.
Change in C compiler behavior causes resultant buffer overflows in programs that depend on behaviors that were undefined in the C standard.
View DetailsCWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity. This can lead to resultant weaknesses when the required properties change, such as when the product is ported to a different platform or if an interaction error (CWE-435) occurs.
If exploited, CWE-758 (Reliance on Undefined, Unspecified, or Implementation-Defined Behavior) it can compromise Other, leading to outcomes such as Other.
MITRE documents real CVEs mapped to CWE-758, including CVE-2006-1902. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-758 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.