A feature, API, or function does not perform according to its specification.

What CVEs are caused by CWE-440?

39 recorded CVEs are attributed to CWE-440, including CVE-2019-6569, CVE-2025-8850, CVE-2026-8806.

What are the consequences of CWE-440?

Exploiting CWE-440 can lead to: Quality Degradation, Varies by Context.

Is CWE-440 actively exploited?

39 recorded CVEs are caused by CWE-440; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-440: Expected Behavior Violation

Overview

CWE-440 (Expected Behavior Violation) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

39 recorded CVEs are caused by CWE-440 (Expected Behavior Violation). The highest-severity and most recent are shown first. 8 new CWE-440 CVEs have been recorded so far in 2026 (12 in 2025).

CVE-2019-6569
Critical · CVSS 9.1 · EPSS 69th
2019-03-26
CVE-2025-8850
Insecure API Design in danny-avila/librechat
High · CVSS 8.8 · EPSS 34th
2025-10-30
CVE-2026-8806
Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series FX5-ENET/IP Ethernet module
High · CVSS 8.7 · EPSS 48th
2026-06-19
CVE-2018-12550
High · CVSS 8.1 · EPSS 70th
2019-03-27
CVE-2023-4807
POLY1305 MAC implementation corrupts XMM registers on Windows
High · CVSS 7.8 · EPSS 56th
2023-09-08
CVE-2023-32731
High · CVSS 7.5 · EPSS 41th
2023-06-09
CVE-2022-3281
High · CVSS 7.5 · EPSS 51th
2022-10-17
CVE-2026-65934
BT122 plaintext pause encryption request causes DOS
High · CVSS 7.1 · EPSS 1th
2026-08-13
CVE-2025-52953
Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker sending a valid BGP UPDATE packet forces a BGP session reset
High · CVSS 7.1 · EPSS 21th
2025-07-11
CVE-2026-42534
Jostle logic bypass degrades resolution performance
Medium · CVSS 6.9 · EPSS 46th
2026-05-20
CVE-2026-3344
WatchGuard Firebox System Integrity Check Bypass
Medium · CVSS 6.9 · EPSS 20th
2026-03-03
CVE-2024-47762
Medium · CVSS 6.9 · EPSS 30th
2024-10-03

Showing 12 of 39 recorded CWE-440 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-440 vulnerabilities

Common consequences

What can happen when CWE-440 is exploited.

Quality Degradation, Varies by Context

Affects: Other

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Implementation

Operation

Applies to

Technologies

ICS/OT

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

The provided code is extracted from the Control and Status Register (CSR), csr_regfile, module within the Hack@DAC'21 OpenPiton System-on-Chip (SoC). This module is designed to implement CSR registers in accordance with the RISC-V specification. The mie (machine interrupt enable) register is a 64-bit register [REF-1384], where bits correspond to different interrupt sources. As the name suggests, mie is a machine-level register that determines which interrupts are enabled. Note that in the example below the mie_q and mie_d registers represent the conceptual mie reigster in the RISC-V specification. The mie_d register is the value to be stored in the mie register while the mie_q register holds the current value of the mie register [REF-1385].

Vulnerable example

verilog

if (csr_we) begin

Safe example

verilog

if (csr_we) begin

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2003-0187 — Program uses large timeouts on unconfirmed connections resulting from inconsistency in linked lists implementations.
CVE-2003-0465 — "strncpy" in Linux kernel acts different than libc on x86, leading to expected behavior difference - sort of a multiple interpretation error?
CVE-2005-3265 — Buffer overflow in product stems the use of a third party library function that is expected to have internal protection against overflows, but doesn't.

How this weakness relates to others in the CWE hierarchy.

Parent

CWE-684: Incorrect Provision of Specified Functionality

Child

CWE-1434: Insecure Setting of Generative AI/ML Model Inference Parameters

Terminology & mappings

Mapped taxonomies

PLOVER: Expected behavior violation

Frequently asked questions

Common questions about CWE-440.

What is CWE-440?: A feature, API, or function does not perform according to its specification.
What CVEs are caused by CWE-440?: 39 recorded CVEs are attributed to CWE-440, including CVE-2019-6569, CVE-2025-8850, CVE-2026-8806.
What are the consequences of CWE-440?: Exploiting CWE-440 can lead to: Quality Degradation, Varies by Context.
Is CWE-440 actively exploited?: 39 recorded CVEs are caused by CWE-440; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.