CWE-1339 covers code that stores a real number in a form that does not keep the accuracy and precision the calculation needs, producing an incorrect result. It applies in any language that uses floating point.
How it happens
When a security decision or calculation needs exact numbers, such as financial amounts or prices, small variations can be exploited. Every representation of a fraction has a limit. A fixed number of digits may be too few. Some values never terminate, like 0.333 repeating or irrational numbers. Rounding then makes computer results diverge from accurate math.
Python shows the classic case:
# Vulnerable: binary floating point for money
total = 0.1 + 0.2
print(total == 0.3) # False
# Safer: exact decimal arithmetic for money
from decimal import Decimal
total = Decimal("0.1") + Decimal("0.2")
print(total == Decimal("0.3")) # True
The record shows how this weakness chains into worse bugs:
- CVE-2018-16069: floating point precision errors in a browser rendering engine cause an out-of-bounds read that gives access to cross-origin data.
- CVE-2017-7619: a rounding error in an image processor leads to an infinite loop.
- CVE-2021-29529: a machine-learning product can hit a heap buffer overflow when integer bounds are computed with ceiling and floor on floating point values.
- CVE-2008-2108: insufficient precision in a random number generator reliably produces some zero bits, reducing entropy.
What an attacker gains
MITRE lists several outcomes. Undefined results can crash the program. Wrong math can cause an incorrect answer and, in some contexts, code execution. The weakness can also trigger buffer overflows, which MITRE notes are usually outside a product's implicit security policy.
How to find it
Static analysis can find some instances by modeling data flow. Beyond that, search for floating point types in code that handles money, limits, sizes, indexes or cryptographic values.
How to fix it
Move to a more accurate representation. In extreme cases that means ratios of big integers, or Unum reals. MITRE warns about the tradeoff: floating point is implemented in hardware, so most format changes move calculations into software, which is slower. Measure memory and CPU cost first.
Quick check
What should you use for currency amounts?
An exact representation such as decimal types or integer minor units, instead of binary floating point.
