The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption.

Primary
This weakness does not depend on other weaknesses and is the result of choices made during optimization.

Architecture and Design
Optimizations built into the design of a product can have unintended consequences during execution.

Low

Integrity
Alter Execution Logic
The optimizations alter the order of execution resulting in side effects that were not intended by the original developer.

The following code reads a password from the
user, uses the password to connect to a back-end
mainframe, and then attempts to scrub the password from
memory using memset().

void GetData(char *MFAddr) {

char pwd[64];
if (GetPasswordFromUser(pwd, sizeof(pwd))) {

if (ConnectToMainframe(MFAddr, pwd)) {

// Interaction with mainframe

}

}
memset(pwd, 0, sizeof(pwd));

}

The code in the example will behave
correctly if it is executed verbatim, but if the code
is compiled using an optimizing compiler, then the call to
memset() might be removed as a dead store, because the
buffer pwd is not used after its value is overwritten.
Because the buffer pwd contains a sensitive
value, the application may be vulnerable to attack if
the data are left memory resident. If attackers are
able to access the correct region of memory, they may
use the recovered password to gain control of the
system.
It is common practice to overwrite sensitive
data manipulated in memory, such as passwords or
cryptographic keys, in order to prevent attackers from
learning system secrets. However, with the advent of
optimizing compilers, programs do not always behave as
their source code alone would suggest. In the example,
the compiler interprets the call to memset() as dead
code because the memory being written to is not
subsequently used, despite the fact that there is
clearly a security motivation for the operation to
occur. The problem here is that many compilers, and in
fact many programming languages, do not take this and
other security concerns into consideration in their
efforts to improve efficiency.
Attackers typically exploit this type of
vulnerability by using a core dump or runtime mechanism
to access the memory used by a particular application
and recover the secret information. Once an attacker
has access to the secret information, it is relatively
straightforward to further exploit the system and
possibly compromise other resources with which the
application interacts.

CVE-2017-5715
Intel, ARM, and AMD processor optimizations related to speculative execution and branch prediction cause access control checks to be bypassed when placing data into the cache. Often known as "Spectre".
https://www.cve.org/CVERecord?id=CVE-2017-5715

CVE-2008-1685
C compiler optimization, as allowed by specifications, removes code that is used to perform checks to detect integer overflows.
https://www.cve.org/CVERecord?id=CVE-2008-1685

Allowed-with-Review
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

CWE Content Team
MITRE
2018-03-07
3.1
2018-03-29

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Demonstrative_Examples