The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.

What CVEs are caused by CWE-1025?

11 recorded CVEs are attributed to CWE-1025, including CVE-2026-75840, CVE-2025-71377, CVE-2024-20342.

What are the consequences of CWE-1025?

Exploiting CWE-1025 can lead to: Varies by Context.

Is CWE-1025 actively exploited?

11 recorded CVEs are caused by CWE-1025; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-1025: Comparison Using Wrong Factors

Overview

CWE-1025 (Comparison Using Wrong Factors) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

11 recorded CVEs are caused by CWE-1025 (Comparison Using Wrong Factors). The highest-severity and most recent are shown first. 6 new CWE-1025 CVEs have been recorded so far in 2026 (4 in 2025).

CVE-2026-75840
ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex
High · CVSS 8.7 · EPSS 24th
2026-08-18
CVE-2025-71377
stoatchat before 20250210-1 Unrestricted Message History Fetch
High · CVSS 8.7 · EPSS 49th
2026-07-16
CVE-2024-20342
High · CVSS 8.6 · EPSS 40th
2024-10-23
CVE-2026-9800
Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison
High · CVSS 8.1 · EPSS 48th
2026-06-25
CVE-2026-48860
Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist
High · CVSS 7.5 · EPSS 9th
2026-06-10
CVE-2026-40880
Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks
High · CVSS 7.2 · EPSS 18th
2026-04-21
CVE-2025-32464
Medium · CVSS 6.8 · EPSS 51th
2025-04-09
CVE-2026-40227
Medium · CVSS 6.2 · EPSS 10th
2026-04-10
CVE-2025-2888
Improper timestamp caching during snapshot rollback in tough
Medium · CVSS 5.7 · EPSS 24th
2025-03-27
CVE-2025-2887
Failure to detect delegated target rollback in tough
Medium · CVSS 5.7 · EPSS 24th
2025-03-27
CVE-2025-27839
Low · CVSS 3.2 · EPSS 28th
2025-03-07

Common consequences

What can happen when CWE-1025 is exploited.

Varies by Context

Affects: Other

This can lead to incorrect results and resultant weaknesses. For example, the code might inadvertently compare references to objects, instead of the relevant contents of those objects, causing two "equal" objects to be considered unequal.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

How to detect it

Manual Static Analysis

Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

In the example below, two Java String objects are declared and initialized with the same string values. An if statement is used to determine if the strings are equivalent.

Vulnerable example

java

String str1 = new String("Hello");

Safe example

java

if (str1.equals(str2)) {

However, the if statement will not be executed as the strings are compared using the "==" operator. For Java objects, such as String objects, the "==" operator compares object references, not object values. While the two String objects above contain the same string values, they refer to different object references, so the System.out.println statement will not be executed. To compare object values, the previous code could be modified to use the equals method:

How this weakness relates to others in the CWE hierarchy.

Parent

CWE-697: Incorrect Comparison

Child

Frequently asked questions

Common questions about CWE-1025.

What is CWE-1025?: The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.
What CVEs are caused by CWE-1025?: 11 recorded CVEs are attributed to CWE-1025, including CVE-2026-75840, CVE-2025-71377, CVE-2024-20342.
How is CWE-1025 detected?: Manual Static Analysis: Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.
What are the consequences of CWE-1025?: Exploiting CWE-1025 can lead to: Varies by Context.
Is CWE-1025 actively exploited?: 11 recorded CVEs are caused by CWE-1025; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.