CWE · MITRE source
CWE-670Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
This weakness captures cases in which a particular code segment is always incorrect with respect to the algorithm that it is implementing. For example, if a C programmer intends to include multiple statements in a single block but does not include the enclosing braces (CWE-483), then the logic is always incorrect. This issue is in contrast to most weaknesses in which the code usually behaves correctly, except when it is externally manipulated in malicious ways.
Last updated: 16 October 2026 07:24 UTC
NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2024-32896 KEV UPD | 8.5 | 7.8 | 0.0299 | 2024-06-13 |
CVE-2019-17192 UPD | 7.8 | 9.8 | 0.0273 | 2019-10-05 |
CVE-2020-1914 UPD | 7.7 | 9.8 | 0.0251 | 2020-10-08 |
CVE-2020-17466 UPD | 7.6 | 9.8 | 0.0147 | 2020-08-11 |
CVE-2025-43359 UPD | 7.5 | 9.8 | 0.0093 | 2025-09-15 |
CVE-2022-25745 UPD | 7.3 | 9.8 | 0.0042 | 2023-04-13 |
CVE-2026-96760 | 7.2 | 9.8 | 0.0028 | 2026-09-28 |
CVE-2020-9425 UPD | 7.1 | 7.5 | 0.1904 | 2020-03-20 |
CVE-2025-29312 UPD | 6.9 | 9.1 | 0.0048 | 2025-03-24 |
CVE-2026-55276 | 6.9 | 9.1 | 0.0061 | 2026-06-29 |
CVE-2018-16766 UPD | 6.8 | 8.8 | 0.0127 | 2018-09-10 |
CVE-2026-16392 UPD | 6.8 | 9.1 | 0.0036 | 2026-07-21 |
CVE-2022-2993 UPD | 6.6 | 8.6 | 0.0059 | 2022-12-09 |
CVE-2023-20558 UPD | 6.6 | 8.8 | 0.0067 | 2023-04-02 |
CVE-2023-31211 UPD | 6.6 | 8.8 | 0.0051 | 2024-01-12 |
CVE-2022-29255 UPD | 6.5 | 8.2 | 0.0133 | 2022-06-09 |
CVE-2023-1668 UPD | 6.5 | 8.2 | 0.0122 | 2023-04-10 |
CVE-2021-41153 UPD | 6.4 | 8.7 | 0.0103 | 2021-10-18 |
CVE-2024-32971 UPD | 6.4 | 9.0 | 0.0073 | 2024-05-02 |
CVE-2024-52811 UPD | 6.4 | 8.2 | 0.0084 | 2024-11-25 |
CVE-2025-38291 UPD | 6.4 | 8.8 | 0.0022 | 2025-07-10 |
CVE-2019-9946 UPD | 6.3 | 7.5 | 0.0316 | 2019-04-02 |
CVE-2020-36277 UPD | 6.3 | 7.5 | 0.0243 | 2021-03-11 |
CVE-2022-31116 UPD | 6.3 | 7.5 | 0.0255 | 2022-07-05 |
CVE-2024-20480 UPD | 6.3 | 8.6 | 0.0057 | 2024-09-25 |