CWE-691: Insufficient Control Flow Management
The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
32 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-79033 — Insufficient control flow management in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker lever
- CVE-2025-25273 — Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before versio
- CVE-2025-22893 — Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before versio
- CVE-2025-20004 — Insufficient control flow management in the Alias Checking Trusted Module for some Intel(R) Xeon(R) 6 processor E-Cores
- CVE-2025-35963 — Insufficient control flow management for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 w
- CVE-2024-33617 — Insufficient control flow management in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow in
- CVE-2025-24305 — Insufficient control flow management in the Alias Checking Trusted Module (ACTM) firmware for some Intel(R) Xeon(R) proc
- CVE-2026-20276 — Cisco IOS XR Software Security Hardening Release: September 2026
- CVE-2026-20271 — Cisco IOS XE Software Security Hardening Release
- CVE-2024-29079 — Insufficient control flow management in some Intel(R) VROC software before version 8.6.0.3001 may allow an authenticated
- CVE-2024-22374 — Insufficient control flow management for some Intel(R) Xeon Processors may allow an authenticated user to potentially en
- CVE-2025-49463 — Zoom Clients for iOS - Insufficient Control Flow Management
- CVE-2025-20022 — Insufficient control flow management for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow a p
- CVE-2026-5938 — Foxit PDF Editor/Reader Infinite Loop Denial-of-Service Vulnerability
- CVE-2024-37158 — Evmos is missing precompile checks
- CVE-2025-47774 — Vyper's `slice()` may elide side-effects when output length is 0
- CVE-2025-47285 — Vyper's `concat()` builtin may elide side-effects for zero-length arguments
Recently published
- CVE-2026-20276 — Cisco IOS XR Software Security Hardening Release: September 2026
- CVE-2026-79033 — Insufficient control flow management in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker lever
- CVE-2026-20271 — Cisco IOS XE Software Security Hardening Release
- CVE-2026-5938 — Foxit PDF Editor/Reader Infinite Loop Denial-of-Service Vulnerability
- CVE-2025-35963 — Insufficient control flow management for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 w
- CVE-2025-25273 — Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before versio
- CVE-2025-24305 — Insufficient control flow management in the Alias Checking Trusted Module (ACTM) firmware for some Intel(R) Xeon(R) proc
- CVE-2025-22893 — Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before versio
- CVE-2025-49463 — Zoom Clients for iOS - Insufficient Control Flow Management
- CVE-2025-47774 — Vyper's `slice()` may elide side-effects when output length is 0
- CVE-2025-47285 — Vyper's `concat()` builtin may elide side-effects for zero-length arguments
- CVE-2025-20022 — Insufficient control flow management for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow a p
- CVE-2025-20004 — Insufficient control flow management in the Alias Checking Trusted Module for some Intel(R) Xeon(R) 6 processor E-Cores
- CVE-2024-33617 — Insufficient control flow management in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow in
- CVE-2024-29079 — Insufficient control flow management in some Intel(R) VROC software before version 8.6.0.3001 may allow an authenticated
- CVE-2024-22374 — Insufficient control flow management for some Intel(R) Xeon Processors may allow an authenticated user to potentially en
- CVE-2024-37158 — Evmos is missing precompile checks
More specific weaknesses
- CWE-1281 — Sequence of Processor Instructions Leads to Unexpected Behavior
- CWE-430 — Deployment of Wrong Handler
- CWE-431 — Missing Handler
- CWE-670 — Always-Incorrect Control Flow Implementation
- CWE-696 — Incorrect Behavior Order
- CWE-705 — Incorrect Control Flow Scoping
- CWE-768 — Incorrect Short Circuit Evaluation
- CWE-799 — Improper Control of Interaction Frequency
- CWE-834 — Excessive Iteration
- CWE-841 — Improper Enforcement of Behavioral Workflow