Common Weakness Enumeration
CWE-758
Allowed-with-ReviewReliance on Undefined, Unspecified, or Implementation-Defined Behavior
Abstraction: Class · Status: Incomplete
The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.
36 vulnerabilities reference this CWE, most recent first.
GHSA-CP45-6Q6C-3772
Vulnerability from github – Published: 2026-07-21 21:32 – Updated: 2026-08-18 21:31
VLAI
Details
In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.
Severity
9.6 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-16441"
],
"database_specific": {
"cwe_ids": [
"CWE-758"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-21T19:17:09Z",
"severity": "MODERATE"
},
"details": "In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.",
"id": "GHSA-cp45-6q6c-3772",
"modified": "2026-08-18T21:31:36Z",
"published": "2026-07-21T21:32:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/eclipse-openj9/openj9/security/advisories/GHSA-hcfc-9hjx-2q7f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16441"
},
{
"type": "WEB",
"url": "https://github.com/eclipse-openj9/openj9/pull/24396"
},
{
"type": "WEB",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/194"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GFXP-F68G-8X78
Vulnerability from github – Published: 2025-09-15 13:57 – Updated: 2025-09-15 13:57
VLAI
Summary
LibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained
Details
In version 0.0.4, libyml::string::yaml_string_extend was revised resulting in undefined behaviour, which is unsound.
The GitHub project for libyml was archived after unsoundness issues were raised.
If you rely on this crate, it is highly recommended switching to a maintained alternative.
Recommended alternatives
libyaml-saferunsafe-libyaml-norway- Maintained fork ofunsafe-libyaml
Severity
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "libyml"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.4"
},
{
"last_affected": "0.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-758"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-15T13:57:29Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "In version 0.0.4, `libyml::string::yaml_string_extend` was revised resulting in undefined behaviour, which is unsound.\n\nThe GitHub project for `libyml` was archived after unsoundness issues were raised.\n\nIf you rely on this crate, it is highly recommended switching to a maintained alternative.\n\n## Recommended alternatives\n\n- [`libyaml-safer`](https://crates.io/crates/libyaml-safer) \n- [`unsafe-libyaml-norway`](https://crates.io/crates/unsafe-libyaml-norway) - Maintained fork of `unsafe-libyaml`",
"id": "GHSA-gfxp-f68g-8x78",
"modified": "2025-09-15T13:57:29Z",
"published": "2025-09-15T13:57:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rustsec/advisory-db/issues/2395"
},
{
"type": "PACKAGE",
"url": "https://github.com/sebastienrousseau/libyml"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2025-0067.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "LibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained"
}
GHSA-J97Q-98F4-5WQ3
Vulnerability from github – Published: 2026-03-24 15:30 – Updated: 2026-03-25 21:30
VLAI
Details
Undefined behavior in the Audio/Video component. This vulnerability affects Firefox < 149.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-4724"
],
"database_specific": {
"cwe_ids": [
"CWE-758"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-24T13:16:08Z",
"severity": "CRITICAL"
},
"details": "Undefined behavior in the Audio/Video component. This vulnerability affects Firefox \u003c 149.",
"id": "GHSA-j97q-98f4-5wq3",
"modified": "2026-03-25T21:30:28Z",
"published": "2026-03-24T15:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4724"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014865"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-20"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-23"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MRXG-J2XH-WG8Q
Vulnerability from github – Published: 2026-03-24 15:30 – Updated: 2026-03-24 21:31
VLAI
Details
Undefined behavior in the WebRTC: Signaling component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-4705"
],
"database_specific": {
"cwe_ids": [
"CWE-758"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-24T13:16:06Z",
"severity": "CRITICAL"
},
"details": "Undefined behavior in the WebRTC: Signaling component. This vulnerability affects Firefox \u003c 149 and Firefox ESR \u003c 140.9.",
"id": "GHSA-mrxg-j2xh-wg8q",
"modified": "2026-03-24T21:31:22Z",
"published": "2026-03-24T15:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4705"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014873"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-20"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-22"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-23"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-24"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QG24-8XJ4-GJ2H
Vulnerability from github – Published: 2021-08-25 20:58 – Updated: 2021-08-18 20:17
VLAI
Summary
Unaligned memory allocation in chunky
Details
An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "chunky"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.3.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-36433"
],
"database_specific": {
"cwe_ids": [
"CWE-758"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-18T20:17:28Z",
"nvd_published_at": "2021-08-08T06:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.",
"id": "GHSA-qg24-8xj4-gj2h",
"modified": "2021-08-18T20:17:28Z",
"published": "2021-08-25T20:58:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36433"
},
{
"type": "WEB",
"url": "https://github.com/aeplay/chunky/issues/2"
},
{
"type": "PACKAGE",
"url": "https://github.com/aeplay/chunky"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2020-0035.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Unaligned memory allocation in chunky"
}
GHSA-V57J-J5HJ-CGF3
Vulnerability from github – Published: 2025-10-02 00:32 – Updated: 2025-10-02 00:32
VLAI
Details
OpenPLC_V3 has a vulnerability in the enipThread function that occurs due to the lack of a return value. This leads to a crash when the server loop ends and execution hits an illegal ud2 instruction. This issue can be triggered remotely without authentication by starting the same server multiple times or if the server exits unexpectedly. The vulnerability allows an attacker to cause a Denial of Service (DoS) against the PLC runtime, stopping any PC started remotely without authentication. This results in the PLC process crashing and halting all automation or control logic managed by OpenPLC.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-54811"
],
"database_specific": {
"cwe_ids": [
"CWE-758"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-01T22:15:31Z",
"severity": "MODERATE"
},
"details": "OpenPLC_V3 has a vulnerability in the enipThread function that occurs due to the lack of a return value. This leads to a crash when the server loop ends and execution hits an illegal ud2 instruction. This issue can be triggered remotely without authentication by starting the same server multiple times or if the server exits unexpectedly. The vulnerability allows an attacker to cause a Denial of Service (DoS) against the PLC runtime, stopping any PC started remotely without authentication. This results in the PLC process crashing and halting all automation or control logic managed by OpenPLC.",
"id": "GHSA-v57j-j5hj-cgf3",
"modified": "2025-10-02T00:32:09Z",
"published": "2025-10-02T00:32:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54811"
},
{
"type": "WEB",
"url": "https://github.com/thiagoralves/OpenPLC_v3"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-05"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.