An exception is thrown from a function, but it is not caught.

What CVEs are caused by CWE-248?

211 recorded CVEs are attributed to CWE-248, including CVE-2025-12423, CVE-2018-11466, CVE-2024-42037.

How is CWE-248 detected?

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

What are the consequences of CWE-248?

Exploiting CWE-248 can lead to: DoS: Crash, Exit, or Restart, Read Application Data.

Is CWE-248 actively exploited?

211 recorded CVEs are caused by CWE-248; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-248: Uncaught Exception

RadicalNotion.AI

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

The following example attempts to resolve a hostname.

Vulnerable example

java

protected void doPost (HttpServletRequest req, HttpServletResponse res) throws IOException {

A DNS lookup failure will cause the Servlet to throw an exception.

The _alloca() function allocates memory on the stack. If an allocation request is too large for the available stack space, _alloca() throws an exception. If the exception is not caught, the program will crash, potentially enabling a denial of service attack. _alloca() has been deprecated as of Microsoft Visual Studio 2005(R). It has been replaced with the more secure _alloca_s().

EnterCriticalSection() can raise an exception, potentially causing the program to crash. Under operating systems prior to Windows 2000, the EnterCriticalSection() function can raise an exception in low memory situations. If the exception is not caught, the program will crash, potentially enabling a denial of service attack.

CWE-248: Uncaught Exception

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Terminology & mappings

Mapped taxonomies

Frequently asked questions

References

Stay ahead of CWE-248

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Related weaknesses

Parent

Child

Terminology & mappings

Mapped taxonomies

Frequently asked questions

References

Stay ahead of CWE-248