The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.

Primary

Indirect

Implementation

High

Other
Varies by Context
Quality Degradation
Unexpected State
If the function is used incorrectly, then it could result in security problems.

Automated Static Analysis - Binary or Bytecode

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Bytecode Weakness Analysis - including disassembler + source code weakness analysis
Binary Weakness Analysis - including disassembler + source code weakness analysis

Cost effective for partial coverage:

Binary / Bytecode Quality Analysis
Binary / Bytecode simple extractor - strings, ELF readers, etc.

High

Manual Static Analysis - Binary or Bytecode

According to SOAR [REF-1479], the following detection techniques may be useful:

Cost effective for partial coverage:

Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies

SOAR Partial

Dynamic Analysis with Manual Results Interpretation

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Debugger

Cost effective for partial coverage:

Monitored Virtual Environment - run potentially malicious code in sandbox / wrapper / virtual machine, see if it does anything suspicious

High

Manual Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Manual Source Code Review (not inspections)

Cost effective for partial coverage:

Focused Manual Spotcheck - Focused manual analysis of source

High

Automated Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Source code Weakness Analyzer
Context-configured Source Code Weakness Analyzer

Cost effective for partial coverage:

Warning Flags
Source Code Quality Analyzer

High

Automated Static Analysis

According to SOAR [REF-1479], the following detection techniques may be useful:

Cost effective for partial coverage:

Origin Analysis

SOAR Partial

Architecture or Design Review

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Formal Methods / Correct-By-Construction
Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)

High

Build and Compilation
Implementation
Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the "banned.h" include file from Microsoft's SDL. [REF-554] [REF-7]

The following code attempts to create a local copy of a buffer to perform some manipulations to the data.

void manipulate_string(char * string){char buf[24];strcpy(buf, string);...}

However, the programmer does not ensure that the size of the data pointed to by string will fit in the local buffer and copies the data with the potentially dangerous strcpy() function. This may result in a buffer overflow condition if an attacker can influence the contents of the string parameter.

CVE-2007-1470
Library has multiple buffer overflows using sprintf() and strcpy()
https://www.cve.org/CVERecord?id=CVE-2007-1470

CVE-2009-3849
Buffer overflow using strcat()
https://www.cve.org/CVERecord?id=CVE-2009-3849

CVE-2006-2114
Buffer overflow using strcpy()
https://www.cve.org/CVERecord?id=CVE-2006-2114

CVE-2006-0963
Buffer overflow using strcpy()
https://www.cve.org/CVERecord?id=CVE-2006-0963

CVE-2011-0712
Vulnerable use of strcpy() changed to use safer strlcpy()
https://www.cve.org/CVERecord?id=CVE-2011-0712

CVE-2008-5005
Buffer overflow using strcpy()
https://www.cve.org/CVERecord?id=CVE-2008-5005

Dangerous Functions

CON33-C
Avoid race conditions when using library functions
CWE More Abstract

ENV33-C
Do not call system()
CWE More Abstract

ERR07-C
Prefer functions that support error checking over equivalent functions that don't

ERR34-C
Detect errors when converting a string to a number
CWE More Abstract

FIO01-C
Be careful using functions that use file names for identification

MSC30-C
Do not use the rand() function for generating pseudorandom numbers
CWE More Abstract

STR31-C
Guarantee that storage for strings has sufficient space for character data and the null terminator
Imprecise

SFP3
Use of an improper API

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

This weakness is different than CWE-242 (Use of Inherently Dangerous Function). CWE-242 covers functions with such significant security problems that they can never be guaranteed to be safe. Some functions, if used properly, do not directly pose a security risk, but can introduce a weakness if not called correctly. These are regarded as potentially dangerous. A well-known example is the strcpy() function. When provided with a destination buffer that is larger than its source, strcpy() will not overflow. However, it is so often misused that some developers prohibit strcpy() entirely.

7 Pernicious Kingdoms
2008-04-11
Draft 9
2008-04-11

Sean Eidemiller
Cigital
2008-07-01
added/updated demonstrative examples

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Applicable_Platforms, Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities

CWE Content Team
MITRE
2008-11-24
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-07-27
updated Relationships

CWE Content Team
MITRE
2010-02-16
updated Demonstrative_Examples, Other_Notes, References, Relationship_Notes

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences, Observed_Examples, Potential_Mitigations, References, Relationships

CWE Content Team
MITRE
2011-09-13
updated Potential_Mitigations, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated References, Related_Attack_Patterns, Relationships, Weakness_Ordinalities

CWE Content Team
MITRE
2014-07-30
updated Detection_Factors, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-05-03
updated Related_Attack_Patterns

CWE Content Team
MITRE
2017-11-08
updated Causal_Nature, References, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2018-03-27
updated References

CWE Content Team
MITRE
2019-01-03
updated Relationships, Weakness_Ordinalities

CWE Content Team
MITRE
2020-02-24
updated Detection_Factors, References, Relationships

CWE Content Team
MITRE
2020-12-10
updated Demonstrative_Examples

CWE Content Team
MITRE
2021-03-15
updated Demonstrative_Examples

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated References, Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Detection_Factors, References

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships