CWE-687, Function Call With Incorrectly Specified Argument Value, is a call where the function and the argument type are fine, but the value passed is wrong. A permission mode of the wrong number, an off-by-one length, a flag that turns a safety check off.
How it happens
The mistake sits in a literal or a computed value. The compiler cannot object because the value is valid for the type.
// Vulnerable: intent was owner-only, but 0666 makes the file world-writable
int fd = open(path, O_CREAT | O_WRONLY, 0666);
This example is an illustration. The function is used correctly. Only the value is wrong, and only someone who knows the intent can tell.
What an attacker gains
MITRE records quality degradation as the consequence and lists no observed CVEs. Impact is whatever the wrong value controls. A permissions value, a timeout or a size limit could each matter a great deal in the right place.
How to find it
MITRE notes that manual static analysis is the way, and that it may require understanding the intended behavior or design to decide whether a value is incorrect. Reviewers need the spec in hand. Pay extra attention to numeric flags, permission modes, buffer sizes and timeouts.
How to fix it
- Replace magic numbers with named constants so the intent is visible.
- Add tests that assert the resulting behavior, such as the permissions on a created file.
- Review security-relevant arguments with someone who knows the requirement.
// Fixed: named constant states the intent
#define FILE_MODE_OWNER_ONLY 0600
int fd = open(path, O_CREAT | O_WRONLY, FILE_MODE_OWNER_ONLY);
Quick check
Why can tools rarely find this?
Because the value is valid for the type. Only knowledge of the intended behavior shows it is wrong.
