What CVEs are caused by CWE-622?

2 recorded CVEs are attributed to CWE-622, including CVE-2024-0312, CVE-2024-0311.

What are the consequences of CWE-622?

Exploiting CWE-622 can lead to: Unexpected State.

Is CWE-622 actively exploited?

2 recorded CVEs are caused by CWE-622; none are currently in CISA's KEV catalog of actively exploited flaws.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Variant weakness

Draft

CWE-622: Improper Validation of Function Hook Arguments

The product adds hooks to user-accessible API functions, but it does not properly validate the arguments. This could lead to resultant vulnerabilities.

Last updated May 1, 2026

2

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Variant

Abstraction

MITRE classification

Overview

Such hooks can be used in defensive software that runs with privileges, such as anti-virus or firewall, which hooks kernel calls. When the arguments are not validated, they could be used to bypass the protection scheme or attack the product itself.

Real-world CVEs

2 recorded CVEs are caused by CWE-622 (Improper Validation of Function Hook Arguments). The highest-severity and most recent are shown first.

Common consequences

What can happen when CWE-622 is exploited.

Unexpected State

Affects: Integrity

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

How to prevent it

Practical mitigations for CWE-622, grouped by where in the lifecycle they apply.

Architecture and Design

Ensure that all arguments are verified, as defined by the API you are protecting.

Architecture and Design

Drop privileges before invoking such functions, if possible.

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2007-0708 — DoS in firewall using standard Microsoft functions
CVE-2006-7160 — DoS in firewall using standard Microsoft functions
CVE-2007-1376 — function does not verify that its argument is the proper type, leading to arbitrary memory write
CVE-2007-1220 — invalid syscall arguments bypass code execution limits
CVE-2006-4541 — DoS in IDS via NULL argument

Terminology & mappings

Mapped taxonomies

Software Fault Patterns: Tainted input to environment (SFP27)

Frequently asked questions

Common questions about CWE-622.

What is CWE-622?: The product adds hooks to user-accessible API functions, but it does not properly validate the arguments. This could lead to resultant vulnerabilities.
What CVEs are caused by CWE-622?: 2 recorded CVEs are attributed to CWE-622, including CVE-2024-0312, CVE-2024-0311.
How do you prevent CWE-622?: Ensure that all arguments are verified, as defined by the API you are protecting.
What are the consequences of CWE-622?: Exploiting CWE-622 can lead to: Unexpected State.
Is CWE-622 actively exploited?: 2 recorded CVEs are caused by CWE-622; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-622

Get alerted the moment a new CWE-622 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing