Compiler Optimization Removal or Modification of Security-critical Code
CWE-733
The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.
We track 4 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1.
Latest Compiler Optimization Removal or Modification of Security-critical Code vulnerabilities
- 7.5 High severity
Firefox: Access of Resource Using Incompatible Type
JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
- 9.8 Critical severity
Firefox: Access of Resource Using Incompatible Type
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
- 7.4 High severity
Cisco NX-OS Software: Compiler Optimization Removal or Modification of Security-critical Code
A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to ca
- 7.8 High severity
mbedtls: Compiler Optimization Removal or Modification of Security-critical Code
Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.