CWE-829: Inclusion of Functionality from Untrusted Control Sphere

low-risk

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Abstraction: Base

Common Consequences

Confidentiality Execute Unauthorized Code or Commands

Detection Methods

Automated Static Analysis - Binary or Bytecode

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Bytecode Weakness Analysis - including disassembler + source code weakness analysis

Manual Static Analysis - Binary or Bytecode

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies

Dynamic Analysis with Manual Results Interpretation

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Forced Path Execution Monitored Virtual Environment - run potentially malicious code in sandbox / wrapper / virtual machine, see if it does anything suspicious

Manual Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Manual Source Code Review (not inspections) Cost effective for partial coverage: Focused Manual Spotcheck - Focused manual analysis of source

Automated Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer

Architecture or Design Review

According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) Formal Methods / Correct-By-Construction Cost effective for partial coverage: Attack Modeling

Real-World Examples (10)

CVE CVSS EPSS KEV
CVE-2018-17246 9.8 93.8%
CVE-2018-7422 7.5 90.3%
CVE-2020-16152 9.8 84.9%
CVE-2021-41569 7.5 73.8%
CVE-2022-25486 7.8 68.8%
CVE-2023-2249 8.8 48.2%
CVE-2022-37191 6.5 46.4%
CVE-2022-29845 6.5 42.2%
CVE-2025-32463 9.3 38.5% Y
CVE-2022-25485 7.8 37.6%
14
/ 100
low-risk
Active Threat 13/50 · Low
Exploit Availability 1/50 · Minimal