CWE-589 is about calling an API function that does not exist on every version of the target platform. MITRE flags the risk as portability problems or inconsistencies that could allow denial of service or other consequences.
Any team that ships software to more than one OS version, device generation, or runtime is exposed.
How it happens
Two situations come up again and again, both described in the record.
- Security features offered by the OS are not available on all versions in common use. Code written on a new release calls them and fails on an older one.
- Functions get deprecated or made obsolete for security reasons, and should not be used. Code that still calls them behaves differently, or not at all, across platforms.
The developer tests on one machine, sees green, and ships. The failure appears in the field on the oldest or newest platform nobody tried.
What an attacker gains
The recorded consequence is quality degradation. This is not a weakness with a neat exploit story. The danger is indirect: a missing or inconsistent security function can quietly disable the protection it was meant to provide, or crash the service. That is the denial of service and "other consequences" the description refers to.
How to find it
Static analysis (SAST) can find some instances by flagging calls to functions known to be deprecated or platform specific. The more reliable signal comes from testing across the supported matrix, since a static tool cannot know which platforms you promise to support.
How to fix it
MITRE's mitigations are all about testing discipline.
- Always test your code on any platform it is targeted to run on.
- Test on the newest and the oldest platform you support.
- Build a check that detects API functions that are not portable, so the list is enforced by tooling and not by memory.
Where a security function may be absent, detect that at startup and fail closed, rather than silently continuing without the protection.
Quick check
Which two platforms does MITRE say to test on?
The newest and the oldest platform on which the code is targeted to run.
