What CVEs are caused by CWE-1038?

6 recorded CVEs are attributed to CWE-1038, including CVE-2025-48877, CVE-2022-26861, CVE-2022-31220.

What are the consequences of CWE-1038?

Exploiting CWE-1038 can lead to: Alter Execution Logic.

Is CWE-1038 actively exploited?

6 recorded CVEs are caused by CWE-1038; none are currently in CISA's KEV catalog of actively exploited flaws.

Class weakness

Draft

CWE-1038: Insecure Automated Optimizations

The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption.

Last updated May 1, 2026

Recorded CVEs

With this primary weakness

KEVs

In the CISA KEV catalog

Low

Likelihood of exploit

Per MITRE

Class

Abstraction

MITRE classification

Overview

CWE-1038 (Insecure Automated Optimizations) is a class-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

6 recorded CVEs are caused by CWE-1038 (Insecure Automated Optimizations). The highest-severity and most recent are shown first. 0 new CWE-1038 CVEs have been recorded so far in 2026 (4 in 2025).

Common consequences

What can happen when CWE-1038 is exploited.

Alter Execution Logic

Affects: Integrity

The optimizations alter the order of execution resulting in side effects that were not intended by the original developer.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

The following code reads a password from the user, uses the password to connect to a back-end mainframe, and then attempts to scrub the password from memory using memset().

Vulnerable example

char pwd[64];

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2017-5715 — Intel, ARM, and AMD processor optimizations related to speculative execution and branch prediction cause access control checks to be bypassed when placing data into the cache. Often known as "Spectre".
CVE-2008-1685 — C compiler optimization, as allowed by specifications, removes code that is used to perform checks to detect integer overflows.

Frequently asked questions

Common questions about CWE-1038.

What is CWE-1038?: The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption.
What CVEs are caused by CWE-1038?: 6 recorded CVEs are attributed to CWE-1038, including CVE-2025-48877, CVE-2022-26861, CVE-2022-31220.
What are the consequences of CWE-1038?: Exploiting CWE-1038 can lead to: Alter Execution Logic.
Is CWE-1038 actively exploited?: 6 recorded CVEs are caused by CWE-1038; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-1038

Get alerted the moment a new CWE-1038 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing