The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.

Primary

Build and Compilation

Access Control
Other
Bypass Protection Mechanism
Alter Execution Logic

Black Box
This specific weakness is impossible to detect using black box methods. While an analyst could examine memory to see that it has not been scrubbed, an analysis of the executable would not be successful. This is because the compiler has already removed the relevant code. Only the source code shows whether the programmer intended to clear the memory or not, so this weakness is indistinguishable from others.
Limited

White Box
This weakness is only detectable using white box methods (see black box detection factor). Careful analysis is required to determine if the code is likely to be removed by the compiler.

The following code reads a password from the
user, uses the password to connect to a back-end
mainframe, and then attempts to scrub the password from
memory using memset().

void GetData(char *MFAddr) {

char pwd[64];
if (GetPasswordFromUser(pwd, sizeof(pwd))) {

if (ConnectToMainframe(MFAddr, pwd)) {

// Interaction with mainframe

}

}
memset(pwd, 0, sizeof(pwd));

}

The code in the example will behave
correctly if it is executed verbatim, but if the code
is compiled using an optimizing compiler, then the call to
memset() might be removed as a dead store, because the
buffer pwd is not used after its value is overwritten.
Because the buffer pwd contains a sensitive
value, the application may be vulnerable to attack if
the data are left memory resident. If attackers are
able to access the correct region of memory, they may
use the recovered password to gain control of the
system.
It is common practice to overwrite sensitive
data manipulated in memory, such as passwords or
cryptographic keys, in order to prevent attackers from
learning system secrets. However, with the advent of
optimizing compilers, programs do not always behave as
their source code alone would suggest. In the example,
the compiler interprets the call to memset() as dead
code because the memory being written to is not
subsequently used, despite the fact that there is
clearly a security motivation for the operation to
occur. The problem here is that many compilers, and in
fact many programming languages, do not take this and
other security concerns into consideration in their
efforts to improve efficiency.
Attackers typically exploit this type of
vulnerability by using a core dump or runtime mechanism
to access the memory used by a particular application
and recover the secret information. Once an attacker
has access to the secret information, it is relatively
straightforward to further exploit the system and
possibly compromise other resources with which the
application interacts.

CVE-2008-1685
C compiler optimization, as allowed by specifications, removes code that is used to perform checks to detect integer overflows.
https://www.cve.org/CVERecord?id=CVE-2008-1685

CVE-2019-1010006
Chain: compiler optimization (CWE-733) removes or modifies code used to detect integer overflow (CWE-190), allowing out-of-bounds write (CWE-787).
https://www.cve.org/CVERecord?id=CVE-2019-1010006

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2008-10-01
1.0.1
2008-10-14
new weakness-focused entry for Research view closes the gap between 14 and 435.

CWE Content Team
MITRE
2008-11-24
updated Detection_Factors

CWE Content Team
MITRE
2009-03-10
updated Applicable_Platforms, Observed_Examples, Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2010-02-16
updated References

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-01-19
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated References, Relationships

CWE Content Team
MITRE
2018-03-27
updated References, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-06-25
updated Observed_Examples

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Demonstrative_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Common_Consequences, Demonstrative_Examples, Detection_Factors, Time_of_Introduction, Weakness_Ordinalities