What CVEs are caused by CWE-733?

5 recorded CVEs are attributed to CWE-733, including CVE-2025-13024, CVE-2025-52496, CVE-2020-15294.

What are the consequences of CWE-733?

Exploiting CWE-733 can lead to: Bypass Protection Mechanism, Alter Execution Logic.

Is CWE-733 actively exploited?

5 recorded CVEs are caused by CWE-733; none are currently in CISA's KEV catalog of actively exploited flaws.

Base weakness

Incomplete

CWE-733: Compiler Optimization Removal or Modification of Security-critical Code

The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.

Last updated May 1, 2026

Recorded CVEs

With this primary weakness

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

CWE-733 (Compiler Optimization Removal or Modification of Security-critical Code) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

5 recorded CVEs are caused by CWE-733 (Compiler Optimization Removal or Modification of Security-critical Code). The highest-severity and most recent are shown first. 0 new CWE-733 CVEs have been recorded so far in 2026 (4 in 2025).

Common consequences

What can happen when CWE-733 is exploited.

Bypass Protection Mechanism, Alter Execution Logic

Affects: Access Control, Other

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Build and Compilation

Applies to

Languages

C (Often)

C++ (Often)

Compiled

How to detect it

Black Box

This specific weakness is impossible to detect using black box methods. While an analyst could examine memory to see that it has not been scrubbed, an analysis of the executable would not be successful. This is because the compiler has already removed the relevant code. Only the source code shows whether the programmer intended to clear the memory or not, so this weakness is indistinguishable from others.

Effectiveness: Limited

White Box

This weakness is only detectable using white box methods (see black box detection factor). Careful analysis is required to determine if the code is likely to be removed by the compiler.

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

The following code reads a password from the user, uses the password to connect to a back-end mainframe, and then attempts to scrub the password from memory using memset().

Vulnerable example

char pwd[64];

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2008-1685 — C compiler optimization, as allowed by specifications, removes code that is used to perform checks to detect integer overflows.
CVE-2019-1010006 — Chain: compiler optimization (CWE-733) removes or modifies code used to detect integer overflow (CWE-190), allowing out-of-bounds write (CWE-787).

Attack patterns

CAPEC attack patterns that exploit this weakness.

Frequently asked questions

Common questions about CWE-733.

What is CWE-733?: The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.
What CVEs are caused by CWE-733?: 5 recorded CVEs are attributed to CWE-733, including CVE-2025-13024, CVE-2025-52496, CVE-2020-15294.
How is CWE-733 detected?: Black Box: This specific weakness is impossible to detect using black box methods. While an analyst could examine memory to see that it has not been scrubbed, an analysis of the executable would not be successful. This is because the compiler has already removed the relevant code. Only the source code shows whether the programmer intended to clear the memory or not, so this weakness is indistinguishable from others.
What are the consequences of CWE-733?: Exploiting CWE-733 can lead to: Bypass Protection Mechanism, Alter Execution Logic.
Is CWE-733 actively exploited?: 5 recorded CVEs are caused by CWE-733; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-733

Get alerted the moment a new CWE-733 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing