Class weakness
Draft
CWE-684: Incorrect Provision of Specified Functionality
The code does not function according to its published specifications, potentially leading to incorrect usage.
Last updated
27
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Not rated
Likelihood of exploit
Per MITRE
Class
Abstraction
MITRE classification
Overview
When providing functionality to an external party, it is important that the product behaves in accordance with the details specified. When requirements of nuances are not documented, the functionality may produce unintended behaviors for the caller, possibly leading to an exploitable state.
Real-world CVEs
27 recorded CVEs are caused by CWE-684 (Incorrect Provision of Specified Functionality). The highest-severity and most recent are shown first. 9 new CWE-684 CVEs have been recorded so far in 2026 (6 in 2025).