CWE-682: Incorrect Calculation

CWE-682 occurs when a program computes an incorrect or unintended value and then relies on it in an operation that affects security or resource management. The defect may involve an expression, operator precedence, a size or length calculation, carry handling, bit manipulation, numeric overflow, precision, or conversion between types. When the faulty result is used for authorization, validation, buffer sizing, or resource allocation, a small arithmetic error can propagate into a security logic failure, an out-of-bounds access, resource exhaustion, or unauthorized code execution.

This weakness arises when a calculation does not represent the program's intended result but its output is still used to determine allocation, security checks, or execution state. Causes can include incorrect operator precedence, omitted terms, carry-propagation errors, overflow, unsuitable precision, type conversion, or mishandling values outside a supported range. The weakness is not specific to a language or technology and is recorded as being introduced during implementation.

An incorrect calculation can cause the program to enter an unexpected state and crash or otherwise impair service. In resource allocation, it can contribute to an out-of-bounds operation, potentially causing a crash or unauthorized code execution, and can also result in integer overflow or other resource consumption problems. In privilege or permission assignment, it may grant access to sensitive resources. If it produces an insufficient comparison, it may weaken a protection mechanism or validation routine and allow an attacker to bypass security-critical logic.

During implementation, understand how the language represents numbers and how that representation affects calculations. Account for byte-size differences, precision, signed and unsigned types, truncation, conversions and casts, NaN behavior, and values outside the representable range. Validate every numeric input against both the required minimum and maximum, choose types appropriate to the operation, and use unsigned types only for values that cannot be negative, such as dimensions or quantities. Select languages, libraries, or frameworks that provide safer numeric handling, including packages such as SafeInt for C++ or IntegerLib for C or C++. Review compiler warnings and eliminate security-relevant issues such as signed and unsigned mismatches in memory operations or use of uninitialized variables.

Detection can use manual analysis, automated static analysis, and fuzzing. Manual static analysis is particularly useful for evaluating allocation calculations and finding overflow conditions; it may be more effective than strictly automated techniques for weaknesses tied to design and business rules. Automated static analysis, or SAST, can analyze source or compiled code without execution by modeling data flow and control flow and searching for potentially vulnerable patterns between input sources and sinks. Fuzzing generates many diverse inputs and invokes the code dynamically, which can expose unexpected results such as crashes, memory corruption, or resource consumption and can produce repeatable test cases; it does not guarantee coverage of every calculation or business rule.

The following are representative recorded examples, not an exhaustive list:

• CVE-2026-7270: an expression omitted parentheses needed for operator precedence, causing an incorrect calculation that led to a buffer overflow.
• CVE-2020-0022: a mobile phone Bluetooth implementation omitted an offset when calculating packet length, leading to an out-of-bounds write.
• CVE-2017-8932: a carry-propagation defect in a cryptographic implementation on x86-64 added a carry bit from an unrelated earlier operation.
• CVE-2010-1378: an incorrect calculation allowed attackers to bypass certificate checks.
• CVE-2004-1363: a substitution overflow occurred because environment variables were expanded after the length check, leading to a buffer overflow.