Cyber Resilience

CWE · MITRE source

CWE-502Deserialization of Untrusted Data

Abstraction: Base · CVEs in our corpus: 3,094

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Last updated: 22 August 2026 20:22 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 1 mapping(s) from 1 framework(s): CAPEC 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A08:2025 Software or Data Integrity Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SI-10 Information Input Validation
  • SI-3 Malicious Code Protection
  • SI-7 Software, Firmware, and Information Integrity
  • CA-8 Penetration Testing
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (7)AI-assisted

Control Title Family Why it addresses this CWE
SI-10Information Input ValidationSIValidates or rejects untrusted serialized data before deserialization occurs.
SI-3Malicious Code ProtectionSIIdentifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
SI-7Software, Firmware, and Information IntegritySIIntegrity verification of serialized information can detect tampering before deserialization occurs.
CA-8Penetration TestingCAPenetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
SA-11Developer Testing and EvaluationSAEvaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
SC-44Detonation ChambersSCUntrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
SR-4ProvenanceSRProvenance of associated data allows detection of untrusted sources before deserialization or processing occurs.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2021-44228 KEV 10.010.01.00002021-12-10
CVE-2023-40044 KEV 10.010.00.90152023-09-27
CVE-2023-46604 KEV 10.010.00.99722023-10-27
CVE-2025-10035 KEV 10.010.00.99582025-09-18
CVE-2025-55182 KEV 10.010.00.99622025-12-03
CVE-2026-20131 KEV 10.010.00.31232026-03-04
CVE-2015-4852 KEV 9.99.80.96032015-11-18
CVE-2015-8103 9.99.80.86712015-11-25
CVE-2015-7450 KEV 9.99.80.97662016-01-02
CVE-2017-5645 9.99.80.89792017-04-17
CVE-2017-3066 KEV 9.99.80.90602017-04-27
CVE-2017-12149 KEV 9.99.80.90712017-10-04
CVE-2015-7501 9.99.80.85562017-11-09
CVE-2017-1000353 KEV 9.99.80.99682018-01-29
CVE-2017-12557 9.99.80.79812018-02-15
CVE-2018-0147 KEV 9.99.80.18212018-03-08
CVE-2018-2628 KEV 9.99.80.99452018-04-19
CVE-2018-4939 KEV 9.99.80.62912018-05-19
CVE-2018-3245 9.99.80.94282018-10-17
CVE-2018-15381 9.99.80.87252018-11-08
CVE-2018-1000861 KEV 9.99.80.98332018-12-10
CVE-2019-0192 9.99.80.77512019-03-07
CVE-2018-19276 9.99.80.98712019-03-21
CVE-2019-10068 KEV 9.99.80.96252019-03-26
CVE-2019-7214 9.99.80.84822019-04-24