CWE-688: Function Call With Incorrect Variable or Reference as Argument
The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one of the arguments, which may lead to undefined behavior and resultant weaknesses.
Last updated
Overview
CWE-688 (Function Call With Incorrect Variable or Reference as Argument) is a variant-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.
Real-world CVEs
3 recorded CVEs are caused by CWE-688 (Function Call With Incorrect Variable or Reference as Argument). The highest-severity and most recent are shown first. 2 new CWE-688 CVEs have been recorded so far in 2026.
Common consequences
What can happen when CWE-688 is exploited.
Quality Degradation
Affects: Other
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Languages
How to prevent it
Practical mitigations for CWE-688, grouped by where in the lifecycle they apply.
Because this function call often produces incorrect behavior it will usually be detected during testing or normal operation of the product. During testing exercise all possible control paths will typically expose this weakness except in rare cases when the incorrect function call accidentally produces the correct results or if the provided argument type is very similar to the expected argument type.
How to detect it
Other
While this weakness might be caught by the compiler in some languages, it can occur more frequently in cases in which the called function accepts variable numbers of arguments, such as format strings in C. It also can occur in loosely typed languages or environments. This might require an understanding of intended program behavior or design to determine whether the value is incorrect.
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
In the following Java snippet, the accessGranted() method is accidentally called with the static ADMIN_ROLES array rather than the user roles.
Vulnerable example
private static final String[] ADMIN_ROLES = ...;Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2005-2548 — Kernel code specifies the wrong variable in first argument, leading to resultant NULL pointer dereference.
Frequently asked questions
Common questions about CWE-688.
- What is CWE-688?
- The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one of the arguments, which may lead to undefined behavior and resultant weaknesses.
- What CVEs are caused by CWE-688?
- 3 recorded CVEs are attributed to CWE-688, including CVE-2026-33549, CVE-2026-76878, CVE-2021-33713.
- How do you prevent CWE-688?
- Because this function call often produces incorrect behavior it will usually be detected during testing or normal operation of the product. During testing exercise all possible control paths will typically expose this weakness except in rare cases when the incorrect function call accidentally produces the correct results or if the provided argument type is very similar to the expected argument type.
- How is CWE-688 detected?
- Other: While this weakness might be caught by the compiler in some languages, it can occur more frequently in cases in which the called function accepts variable numbers of arguments, such as format strings in C. It also can occur in loosely typed languages or environments. This might require an understanding of intended program behavior or design to determine whether the value is incorrect.
- What are the consequences of CWE-688?
- Exploiting CWE-688 can lead to: Quality Degradation.
- Is CWE-688 actively exploited?
- 3 recorded CVEs are caused by CWE-688; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-688) (opens in a new tab)
- CWE-688 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-688
Get alerted the moment a new CWE-688 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.