Variant weakness
Draft
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Last updated
13
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Not rated
Likelihood of exploit
Per MITRE
Variant
Abstraction
MITRE classification
Overview
The use of predictable seeds significantly reduces the number of possible seeds that an attacker would need to test in order to predict which random numbers will be generated by the PRNG.
Real-world CVEs
13 recorded CVEs are caused by CWE-337 (Predictable Seed in Pseudo-Random Number Generator (PRNG)). The highest-severity and most recent are shown first. 2 new CWE-337 CVEs have been recorded so far in 2026 (4 in 2025).