CWE-475, Undefined Behavior for Input to API, describes a function whose behavior is undefined unless its control parameter is set to one specific value. Pass anything else and the documentation makes no promise about what happens.
MITRE marks the entry as incomplete and not language specific. It applies anywhere an API has a parameter that is really a mode switch with only one legal setting.
How it happens
A caller treats a parameter as a free choice because the type allows it. An integer can hold a million values, but the function only defines behavior for one. The code compiles, the tests pass on one system, and a different library version or compiler gives a different result for the other values.
When behavior is undefined, the same call can work, fail quietly or fail loudly, and the result can change between releases. The record gives no further detail or examples.
What an attacker gains
MITRE lists quality degradation that varies by context. No fixed consequence is named, and the record has no observed CVEs. The risk is that the program ends up in a state nobody tested, and an attacker who can influence the parameter can aim at that state.
How to find it
MITRE names static analysis as a detection method. Read the documentation for any parameter described as reserved, must be zero, or must be set to a constant, and check that every call site supplies exactly that value. Do not let outside input reach such a parameter.
How to fix it
The record lists no mitigations. Sound practice follows from the definition. Pass only the documented value, as a named constant rather than a bare number. Validate any caller supplied value before it reaches the API, and wrap the call in a helper that fixes the parameter so no one can vary it by accident.
Quick check
Why use a named constant instead of the number?
It makes the one legal value visible in review and gives you a single place to change if the API ever changes.
