CWE-685, Function Call With Incorrect Number of Arguments, is a caller giving a function too many arguments or too few. MITRE lists C and Perl as affected platforms and says the result is undefined behavior and resultant weaknesses.
It typically starts as a typo or a copy and paste mistake during implementation. The MITRE record lists no observed CVEs for it, so this is a weakness to know about rather than a headline maker.
How it happens
Compilers often catch this one in languages with fixed signatures. The cases they miss are functions that accept a variable number of arguments. The classic one is a C format string, where the format and the argument list must agree, and the compiler is not always checking.
// Vulnerable: the format asks for two values, only one is supplied
printf("user=%s id=%d\n", username);
The function reads a second argument that was never passed. What it picks up is whatever happens to be there.
What an attacker gains
MITRE records the impact as quality degradation: the program does something unintended. How serious that is depends on what the function does with the missing or extra value. Behavior is undefined, so no fixed outcome is promised.
How to find it
MITRE says this is often caught by testing, since the call produces incorrect behavior. Exercising all control paths will typically expose it, except in the rare cases where the bad call accidentally yields the correct result. Error paths and rarely run branches are the usual hiding places, so cover them. Compiler warnings for format strings and argument counts help, and are cheap to turn on.
// Fixed: arguments match the format
printf("user=%s id=%d\n", username, user_id);
How to fix it
Call the function as specified, and let tooling check for you. Turn on format string warnings and treat them as errors. Where the language allows it, mark your own variadic functions with the compiler attributes that enable the same checks. Add tests that run every branch, including the failure ones.
Quick check
Why do variadic functions make this likelier?
Because the compiler cannot always verify that the number and types of arguments match what the function expects.
