The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.

What CVEs are caused by CWE-484?

1 recorded CVEs are attributed to CWE-484, including CVE-2026-44075.

How do you prevent CWE-484?

Omitting a break statement so that one may fall through is often indistinguishable from an error, and therefore should be avoided. If you need to use fall-through capabilities, make sure that you have clearly documented this within the switch statement, and ensure that you have examined all the logical possibilities.

How is CWE-484 detected?

White Box: Omission of a break statement might be intentional, in order to support fallthrough. Automated detection methods might therefore be erroneous. Semantic understanding of expected product behavior is required to interpret whether the code is correct.

What are the consequences of CWE-484?

Exploiting CWE-484 can lead to: Alter Execution Logic.

Is CWE-484 actively exploited?

1 recorded CVEs are caused by CWE-484; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-484: Omitted Break Statement in Switch

1 recorded CVEs are caused by CWE-484 (Omitted Break Statement in Switch). The highest-severity and most recent are shown first. 1 new CWE-484 CVE has been recorded so far in 2026.

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

In both of these examples, a message is printed based on the month passed into the function:

Vulnerable example

java

public void printMessage(int month){

Vulnerable example

void printMessage(int month){

Both examples do not use a break statement after each case, which leads to unintended fall-through behavior. For example, calling "printMessage(10)" will result in the text "OctoberNovemberDecember is a great month" being printed.

CWE-484: Omitted Break Statement in Switch

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

How to detect it

White Box

Black Box

Automated Static Analysis

Code examples

Terminology & mappings

Mapped taxonomies

Frequently asked questions

What is CWE-484?

What CVEs are caused by CWE-484?

How do you prevent CWE-484?

How is CWE-484 detected?

What are the consequences of CWE-484?

Is CWE-484 actively exploited?

References

Stay ahead of CWE-484

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

How to detect it

White Box

Black Box

Automated Static Analysis

Code examples

Related weaknesses

Parent

Terminology & mappings

Mapped taxonomies

Frequently asked questions

What is CWE-484?

What CVEs are caused by CWE-484?

How do you prevent CWE-484?

How is CWE-484 detected?

What are the consequences of CWE-484?

Is CWE-484 actively exploited?

References

Stay ahead of CWE-484