CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.
23 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-21677 — iccDEV has Undefined Behavior in CIccCLUT::Init()
- CVE-2026-24411 — iccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlSegmentedCurve::ToXml()
- CVE-2026-24410 — iccDEV has Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic()
- CVE-2026-24409 — iccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlFloatNum<>::ParseXml()
- CVE-2026-24407 — iccDEV has Undefined Behavior in icSigCalcOp()
- CVE-2026-24404 — iccDEV has Null Pointer Deference and Undefined Behavior in CIccXmlArrayType()
- CVE-2026-21687 — iccDEV has Undefined Behavior in CIccTagCurve::CIccTagCurve()
- CVE-2026-21686 — iccDEV has Undefined Behavior in CIccTagLutAtoB::Validate()
- CVE-2026-21685 — iccDEV has Undefined Behavior in CIccTagLut16::Read()
- CVE-2026-21684 — iccDEV has Undefined Behavior in CIccTagSpectralViewingConditions()
- CVE-2025-54811 — OpenPLC_V3
- CVE-2026-34549 — iccDEV: UB at IccUtil.cpp
- CVE-2026-34547 — iccDEV: UB at IccUtil.cpp
- CVE-2026-34537 — iccDEV: UB in CIccOpDefEnvVar::Exec()
- CVE-2026-34533 — iccDEV: UB in CIccCalculatorFunc::ApplySequence()
- CVE-2026-16441 — Eclipse OpenJ9 : Method resolution default method precedence failure
- CVE-2026-22858 — FreeRDP has a global-buffer-overflow in crypto_base64_decode
- CVE-2026-40279 — BACnet Stack: Undefined-behavior signed left shift in `decode_signed32()`
- CVE-2026-28528 — BlueKitchen BTstack < 1.8.1 AVRCP Browsing Target GET_FOLDER_ITEMS Handler OOB Read / Undefined Behavior
- CVE-2024-58350 — Ghidra < 11.2 - Use After Free in Sleigh Backend via Static Initialization Order
Recently published
- CVE-2026-16441 — Eclipse OpenJ9 : Method resolution default method precedence failure
- CVE-2026-50185 — RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set
- CVE-2024-58350 — Ghidra < 11.2 - Use After Free in Sleigh Backend via Static Initialization Order
- CVE-2026-40279 — BACnet Stack: Undefined-behavior signed left shift in `decode_signed32()`
- CVE-2026-34549 — iccDEV: UB at IccUtil.cpp
- CVE-2026-34547 — iccDEV: UB at IccUtil.cpp
- CVE-2026-34537 — iccDEV: UB in CIccOpDefEnvVar::Exec()
- CVE-2026-34533 — iccDEV: UB in CIccCalculatorFunc::ApplySequence()
- CVE-2026-28528 — BlueKitchen BTstack < 1.8.1 AVRCP Browsing Target GET_FOLDER_ITEMS Handler OOB Read / Undefined Behavior
- CVE-2026-24411 — iccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlSegmentedCurve::ToXml()
- CVE-2026-24410 — iccDEV has Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic()
- CVE-2026-24409 — iccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlFloatNum<>::ParseXml()
- CVE-2026-24407 — iccDEV has Undefined Behavior in icSigCalcOp()
- CVE-2026-24404 — iccDEV has Null Pointer Deference and Undefined Behavior in CIccXmlArrayType()
- CVE-2026-22858 — FreeRDP has a global-buffer-overflow in crypto_base64_decode
- CVE-2026-21687 — iccDEV has Undefined Behavior in CIccTagCurve::CIccTagCurve()
- CVE-2026-21686 — iccDEV has Undefined Behavior in CIccTagLutAtoB::Validate()
- CVE-2026-21685 — iccDEV has Undefined Behavior in CIccTagLut16::Read()
- CVE-2026-21684 — iccDEV has Undefined Behavior in CIccTagSpectralViewingConditions()
- CVE-2026-21677 — iccDEV has Undefined Behavior in CIccCLUT::Init()
More specific weaknesses
- CWE-1102 — Reliance on Machine-Dependent Data Representation
- CWE-1103 — Use of Platform-Dependent Third Party Components
- CWE-1105 — Insufficient Encapsulation of Machine-Dependent Functionality
- CWE-474 — Use of Function with Inconsistent Implementations
- CWE-562 — Return of Stack Variable Address
- CWE-587 — Assignment of a Fixed Address to a Pointer