In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.

Primary

Implementation
Programmers may try to index from a pointer by adding a number of bytes. This is incorrect because C and C++ implicitly scale the operand by the size of the data type.

Medium

Confidentiality
Integrity
Read Memory
Modify Memory
Incorrect pointer scaling will often result in buffer overflow conditions. Confidentiality can be compromised if the weakness is in the context of a buffer over-read or under-read.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

Architecture and Design
Use a platform with high-level memory abstractions.

Implementation
Always use array indexing instead of direct pointer manipulation.

Architecture and Design
Use technologies for preventing buffer overflows.

This example attempts to calculate the position of the second byte of a pointer.

int *p = x;char * second_char = (char *)(p + 1);

In this example, second_char is intended to point to the second byte of p. But, adding 1 to p actually adds sizeof(int) to p, giving a result that is incorrect (3 bytes off on 32-bit platforms). If the resulting memory address is read, this could potentially be an information leak. If it is a write, it could be a security-critical write to unauthorized memory-- whether or not it is a buffer overflow. Note that the above code may also be wrong in other ways, particularly in a little endian environment.

Unintentional pointer scaling

ARR39-C
Do not add or subtract a scaled integer to a pointer
Exact

EXP08-C
Ensure pointer arithmetic is used correctly

SFP1
Glitch in computation

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CLASP
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

KDM Analytics
2008-08-01
added/updated white box definitions

CWE Content Team
MITRE
2008-09-08
updated Applicable_Platforms, Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2008-11-24
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-27
updated Demonstrative_Examples

KDM Analytics
2009-07-17
Improved the White_Box_Definition

CWE Content Team
MITRE
2009-07-27
updated White_Box_Definitions

CWE Content Team
MITRE
2009-10-29
updated Common_Consequences

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Demonstrative_Examples, References, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-06-23
updated Modes_of_Introduction, Other_Notes

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Relationships, Taxonomy_Mappings, White_Box_Definitions

CWE Content Team
MITRE
2019-01-03
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated References

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Detection_Factors, Weakness_Ordinalities

Unintentional Pointer Scaling