CWE-758 · Input Validation and Logic
Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
26CVEs
SortMost likely exploited
26 CVEs with CWE-758 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-4705Undefined behavior in the WebRTC: Signaling componentMozilla · Firefox · CVSS 9.8 · 2026-03-24 | 9.8 | 0.7% | 2026-03-24 |
| CVE-2026-16441Eclipse OpenJ9 : Method resolution default method precedence failureEclipse Foundation · OpenJ9 · CVSS 6.9 · 2026-07-21 | 6.9 | 0.5% | 2026-07-21 |
| CVE-2026-54604OpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1openslide · openslide · CVSS 5.3 · 2026-09-17 | 5.3 | 0.5% | 2026-09-17 |
| CVE-2026-4724Undefined behavior in the Audio/Video componentMozilla · Firefox · CVSS 9.1 · 2026-03-24 | 9.1 | 0.5% | 2026-03-24 |
| CVE-2026-4718Undefined behavior in the WebRTC: Signaling componentMozilla · Firefox · CVSS 8.1 · 2026-03-24 | 8.1 | 0.5% | 2026-03-24 |
| CVE-2026-24407iccDEV has Undefined Behavior in icSigCalcOp()InternationalColorConsortium · iccDEV · CVSS 7.1 · 2026-01-24 | 7.1 | 0.5% | 2026-01-24 |
| CVE-2026-31436dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()Linux · Linux · CVSS 9.8 · 2026-04-22 | 9.8 | 0.5% | 2026-04-22 |
| CVE-2023-30624Wasmtime has Undefined Behavior in Rust runtime functionsbytecodealliance · wasmtime · CVSS 3.9 · 2023-04-27 | 3.9 | 0.4% | 2023-04-27 |
| CVE-2025-55160ImageMagick Undefined Behavior (function-type-mismatch) in CloneSplayTreeImageMagick · ImageMagick · CVSS 6.1 · 2025-08-13 | 6.1 | 0.4% | 2025-08-13 |
| CVE-2024-4774The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics for one of its data members. This vulnerability affects Firefo…Mozilla · Firefox · CVSS 6.5 · 2024-05-14 | 6.5 | 0.4% | 2024-05-14 |
| CVE-2026-21677iccDEV has Undefined Behavior in CIccCLUT::Init()InternationalColorConsortium · iccDEV · CVSS 8.8 · 2026-01-06 | 8.8 | 0.4% | 2026-01-06 |
| CVE-2026-100771Undefined behavior in the DOM: Streams componentMozilla · Firefox · CVSS 8.1 · 2026-09-29 | 8.1 | 0.3% | 2026-09-29 |
| CVE-2026-21687iccDEV has Undefined Behavior in CIccTagCurve::CIccTagCurve()InternationalColorConsortium · iccDEV · CVSS 7.1 · 2026-01-07 | 7.1 | 0.3% | 2026-01-07 |
| CVE-2026-21686iccDEV has Undefined Behavior in CIccTagLutAtoB::Validate()InternationalColorConsortium · iccDEV · CVSS 7.1 · 2026-01-07 | 7.1 | 0.3% | 2026-01-07 |
| CVE-2026-21685iccDEV has Undefined Behavior in CIccTagLut16::Read()InternationalColorConsortium · iccDEV · CVSS 7.1 · 2026-01-07 | 7.1 | 0.3% | 2026-01-07 |
| CVE-2026-21684iccDEV has Undefined Behavior in CIccTagSpectralViewingConditions()InternationalColorConsortium · iccDEV · CVSS 7.1 · 2026-01-07 | 7.1 | 0.3% | 2026-01-07 |
| CVE-2026-40279BACnet Stack: Undefined-behavior signed left shift in `decode_signed32()`bacnet-stack · bacnet-stack · CVSS 3.7 · 2026-04-21 | 3.7 | 0.2% | 2026-04-21 |
| CVE-2026-119133Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tagsbytecodealliance · wasmtime · CVSS 2.6 · 2026-10-29 | 2.6 | 0.2% | 2026-10-29 |
| CVE-2025-54811OpenPLC_V3OpenPLC_V3 · OpenPLC_V3 · CVSS 7.1 · 2025-10-01 | 7.1 | 0.2% | 2025-10-01 |
| CVE-2026-23274netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labelsLinux · Linux · CVSS 7.8 · 2026-03-20 | 7.8 | 0.2% | 2026-03-20 |
| CVE-2026-34549iccDEV: UB at IccUtil.cppInternationalColorConsortium · iccDEV · CVSS 6.2 · 2026-03-31 | 6.2 | 0.2% | 2026-03-31 |
| CVE-2026-34547iccDEV: UB at IccUtil.cppInternationalColorConsortium · iccDEV · CVSS 6.2 · 2026-03-31 | 6.2 | 0.2% | 2026-03-31 |
| CVE-2026-34537iccDEV: UB in CIccOpDefEnvVar::Exec()InternationalColorConsortium · iccDEV · CVSS 6.2 · 2026-03-31 | 6.2 | 0.2% | 2026-03-31 |
| CVE-2026-34533iccDEV: UB in CIccCalculatorFunc::ApplySequence()InternationalColorConsortium · iccDEV · CVSS 6.2 · 2026-03-31 | 6.2 | 0.2% | 2026-03-31 |
| CVE-2026-50185RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are setRustCrypto · utils · CVSS 2 · 2026-07-17 | 2.0 | 0.2% | 2026-07-17 |
| CVE-2024-58350Ghidra < 11.2 - Use After Free in Sleigh Backend via Static Initialization Ordernationalsecurityagency · ghidra · CVSS 2.9 · 2026-06-10 | 2.9 | 0.1% | 2026-06-10 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.