Base weakness

Incomplete

CWE-1287: Improper Validation of Specified Type of Input

The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Last updated May 1, 2026

124

Recorded CVEs

With this primary weakness

1

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

When input does not comply with the expected type, attackers could trigger unexpected errors, cause incorrect actions to take place, or exploit latent vulnerabilities that would not be possible if the input conformed with the expected type. This weakness can appear in type-unsafe programming languages, or in programming languages that support casting or conversion of an input to another type.

Real-world CVEs

124 recorded CVEs are caused by CWE-1287 (Improper Validation of Specified Type of Input), including 1 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 21 new CWE-1287 CVEs have been recorded so far in 2026 (66 in 2025).

CVE-2024-51550

Critical · CVSS 10.0 · EPSS 90th

2024-12-05

CVE-2024-6298

Critical · CVSS 10.0 · EPSS 96th

2024-07-05

CVE-2021-32024

Critical · CVSS 9.8 · EPSS 86th

2021-12-13

CVE-2026-24307

M365 Copilot Information Disclosure Vulnerability

Critical · CVSS 9.3 · EPSS 41th

2026-01-22

CVE-2025-12977

Critical · CVSS 9.1 · EPSS 26th

2025-11-24

CVE-2024-5594

Critical · CVSS 9.1 · EPSS 67th

2025-01-06

CVE-2024-35213

Vulnerability in SGI Image Codec Impacts BlackBerry QNX Software Development Platform (SDP)

Critical · CVSS 9.0 · EPSS 69th

2024-06-11

CVE-2026-26115

SQL Server Elevation of Privilege Vulnerability

High · CVSS 8.8 · EPSS 34th

2026-03-10

CVE-2026-2004

PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

High · CVSS 8.8 · EPSS 19th

2026-02-12

CVE-2024-3175

High · CVSS 8.8 · EPSS 64th

2024-07-16

Showing 12 of 124 recorded CWE-1287 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-1287 vulnerabilities

Common consequences

What can happen when CWE-1287 is exploited.

Varies by Context

Affects: Other

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

How to prevent it

Practical mitigations for CWE-1287, grouped by where in the lifecycle they apply.

Implementation

Input Validation

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

Effectiveness: High

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2024-37032 — Large language model (LLM) management tool does not validate the format of a digest value (CWE-1287) from a private, untrusted model registry, enabling relative path traversal (CWE-23), a.k.a. Probllama
CVE-2008-2223 — SQL injection through an ID that was supposed to be numeric.

Frequently asked questions

Common questions about CWE-1287.

What is CWE-1287?

The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

What CVEs are caused by CWE-1287?

124 recorded CVEs are attributed to CWE-1287, including CVE-2024-4879, CVE-2024-51551, CVE-2024-51550. 1 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

How do you prevent CWE-1287?

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

What are the consequences of CWE-1287?

Exploiting CWE-1287 can lead to: Varies by Context.

Is CWE-1287 actively exploited?

Yes. 1 CWE-1287 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 124 recorded CVEs.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-1287

Get alerted the moment a new CWE-1287 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing