CWE-391Unchecked Error Condition

Abstraction: Base · CVEs in our corpus: 25

[PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.

Last updated: 22 August 2026 14:14 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A10:2025 Mishandling of Exceptional Conditions.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

IR-1 Policy and Procedures
IR-3 Incident Response Testing
IR-4 Incident Handling
AU-5 Response to Audit Logging Process Failures

Detect

Catch it (CSF Detect / Respond)

DE.AE-02
DE.CM-09

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (5)AI-assisted

Control	Title	Family	Why it addresses this CWE
`IR-1`	Policy and Procedures	IR	Policy enforces checking and handling of error conditions as part of incident response processes.
`IR-3`	Incident Response Testing	IR	Testing IR effectiveness identifies and drives fixes for unchecked error conditions that fail to initiate incident handling.
`IR-4`	Incident Handling	IR	Formal incident handling procedures enforce checking and acting on error conditions that could indicate security incidents.
`AU-5`	Response to Audit Logging Process Failures	AU	Ensures audit logging process failures are checked and trigger defined responses instead of remaining unchecked.
`PM-31`	Continuous Monitoring Strategy	PM	Mandates ongoing correlation, analysis, and response to monitoring results, reducing unchecked error conditions from control assessments.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2024-52316`	8.0	9.8	0.0629	2024-11-18
`CVE-2017-12176`	7.9	9.8	0.0417	2018-01-24
`CVE-2017-12177`	7.9	9.8	0.0437	2018-01-24
`CVE-2017-12178`	7.9	9.8	0.0417	2018-01-24
`CVE-2017-12179`	7.9	9.8	0.0437	2018-01-24
`CVE-2017-12180`	7.9	9.8	0.0423	2018-01-24
`CVE-2017-12181`	7.9	9.8	0.0423	2018-01-24
`CVE-2017-12182`	7.9	9.8	0.0423	2018-01-24
`CVE-2017-12183`	7.9	9.8	0.0423	2018-01-24
`CVE-2017-12184`	7.9	9.8	0.0417	2018-01-24
`CVE-2017-12185`	7.9	9.8	0.0417	2018-01-24
`CVE-2017-12186`	7.9	9.8	0.0430	2018-01-24
`CVE-2017-12187`	7.8	9.8	0.0335	2018-01-24
`CVE-2025-71325`	7.3	9.8	0.0047	2026-06-17
`CVE-2026-74900`	7.2	9.8	0.0034	2026-08-17
`CVE-2016-10526`	6.5	8.6	0.0164	2018-05-31
`CVE-2019-14853`	6.3	7.5	0.0241	2019-11-26
`CVE-2020-14383`	5.5	6.5	0.0218	2020-12-02
`CVE-2017-7496`	5.2	7.0	0.0026	2017-06-26
`CVE-2022-22160`	5.1	6.5	0.0036	2022-01-19
`CVE-2023-0572`	4.6	5.3	0.0067	2023-01-29
`CVE-2024-23326`	4.6	5.9	0.0036	2024-06-04
`CVE-2022-20849`	4.5	6.1	0.0028	2024-11-15
`CVE-2018-1091`	4.4	5.5	0.0041	2018-03-27
`CVE-2023-32871`	3.9	5.3	0.0008	2024-05-06