CWE-468: Incorrect Pointer Scaling
In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.
Last updated
Overview
CWE-468 (Incorrect Pointer Scaling) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.
Real-world CVEs
4 recorded CVEs are caused by CWE-468 (Incorrect Pointer Scaling). The highest-severity and most recent are shown first. 2 new CWE-468 CVEs have been recorded so far in 2026.
- CVE-2026-24872
Pointer arithmetic error in SkyFire_548
Critical · CVSS 9.8 · EPSS 21th2026-01-27 - CVE-2024-1915Critical · CVSS 9.8 · EPSS 60th2024-03-15
- CVE-2024-0802Critical · CVSS 9.8 · EPSS 61th2024-03-14
- CVE-2026-34194
GPU DDK - UAF read and/or write to arbitrary physical pages in DevmemIntChangeSparse due to incorrect calculation of the virtual index count
High · CVSS 7.1 · EPSS 2th2026-06-08
Common consequences
What can happen when CWE-468 is exploited.
Read Memory, Modify Memory
Affects: Confidentiality, Integrity
Incorrect pointer scaling will often result in buffer overflow conditions. Confidentiality can be compromised if the weakness is in the context of a buffer over-read or under-read.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Languages
How to prevent it
Practical mitigations for CWE-468, grouped by where in the lifecycle they apply.
Use a platform with high-level memory abstractions.
Always use array indexing instead of direct pointer manipulation.
Use technologies for preventing buffer overflows.
How to detect it
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
This example attempts to calculate the position of the second byte of a pointer.
Vulnerable example
int *p = x;In this example, second_char is intended to point to the second byte of p. But, adding 1 to p actually adds sizeof(int) to p, giving a result that is incorrect (3 bytes off on 32-bit platforms). If the resulting memory address is read, this could potentially be an information leak. If it is a write, it could be a security-critical write to unauthorized memory-- whether or not it is a buffer overflow. Note that the above code may also be wrong in other ways, particularly in a little endian environment.
Terminology & mappings
Mapped taxonomies
- CLASP: Unintentional pointer scaling
- CERT C Secure Coding: Do not add or subtract a scaled integer to a pointer (ARR39-C) — Exact fit
- CERT C Secure Coding: Ensure pointer arithmetic is used correctly (EXP08-C)
- Software Fault Patterns: Glitch in computation (SFP1)
Frequently asked questions
Common questions about CWE-468.
- What is CWE-468?
- In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.
- What CVEs are caused by CWE-468?
- 4 recorded CVEs are attributed to CWE-468, including CVE-2026-24872, CVE-2024-1915, CVE-2024-0802.
- How do you prevent CWE-468?
- Use a platform with high-level memory abstractions.
- How is CWE-468 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-468?
- Exploiting CWE-468 can lead to: Read Memory, Modify Memory.
- Is CWE-468 actively exploited?
- 4 recorded CVEs are caused by CWE-468; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-468) (opens in a new tab)
- CWE-468 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-468
Get alerted the moment a new CWE-468 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.