The product does not correctly convert an object, resource, or structure from one type to a different type.

What CVEs are caused by CWE-704?

75 recorded CVEs are attributed to CWE-704, including CVE-2026-15826, CVE-2025-41648, CVE-2025-41646.

How is CWE-704 detected?

Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.

What are the consequences of CWE-704?

Exploiting CWE-704 can lead to: Other.

Is CWE-704 actively exploited?

75 recorded CVEs are caused by CWE-704; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-704: Incorrect Type Conversion or Cast

RadicalNotion.AI

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

In this example, depending on the return value of accecssmainframe(), the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned value, amount will be implicitly cast to an unsigned number.

Vulnerable example

unsigned int readdata () {

If the return value of accessmainframe() is -1, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers.

The following code uses a union to support the representation of different types of messages. It formats messages differently, depending on their type.

Vulnerable example

#define NAME_TYPE 1

CWE-704: Incorrect Type Conversion or Cast

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to detect it

Fuzzing

Code examples

Illustrative examples

Terminology & mappings

Mapped taxonomies

Frequently asked questions

References

Stay ahead of CWE-704

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to detect it

Fuzzing

Code examples

Illustrative examples

Related weaknesses

Parent

Child

Terminology & mappings

Mapped taxonomies

Frequently asked questions

References

Stay ahead of CWE-704