Cyber Posture

CWE · MITRE source

CWE-502Deserialization of Untrusted Data

Abstraction: Base · CVEs in our corpus: 2,603

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (7)AI

Control Title Family Why it addresses this CWE
SI-10Information Input ValidationSIValidates or rejects untrusted serialized data before deserialization occurs.
SI-3Malicious Code ProtectionSIIdentifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
SI-7Software, Firmware, and Information IntegritySIIntegrity verification of serialized information can detect tampering before deserialization occurs.
CA-8Penetration TestingCAPenetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
SA-11Developer Testing and EvaluationSAEvaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
SC-44Detonation ChambersSCUntrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
SR-4ProvenanceSRProvenance of associated data allows detection of untrusted sources before deserialization or processing occurs.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2021-44228 KEV9.710.00.94462021-12-10
CVE-2023-40044 KEV9.710.00.94442023-09-27
CVE-2023-46604 KEV9.710.00.94442023-10-27
CVE-2015-7450 KEV9.69.80.93272016-01-02
CVE-2017-3066 KEV9.69.80.93682017-04-27
CVE-2017-12149 KEV9.69.80.94292017-10-04
CVE-2017-1000353 KEV9.69.80.94482018-01-29
CVE-2018-2628 KEV9.69.80.94422018-04-19
CVE-2018-1000861 KEV9.69.80.94482018-12-10
CVE-2019-10068 KEV9.69.80.93812019-03-26
CVE-2019-18935 KEV9.69.80.93582019-12-11
CVE-2020-10189 KEV9.69.80.94252020-03-06
CVE-2020-7961 KEV9.69.80.94352020-03-20
CVE-2021-35464 KEV9.69.80.94392021-07-22
CVE-2021-42237 KEV9.69.80.94372021-11-05
CVE-2022-35405 KEV9.69.80.94212022-07-19
CVE-2022-47986 KEV9.69.80.94352023-02-17
CVE-2023-29300 KEV9.69.80.93682023-07-12
CVE-2023-38203 KEV9.69.80.94242023-07-20
CVE-2023-43208 KEV9.69.80.94422023-10-26
CVE-2025-24016 KEV9.69.90.93512025-02-10
CVE-2025-24813 KEV9.69.80.94142025-03-10
CVE-2015-4852 KEV9.59.80.92952015-11-18
CVE-2020-2555 KEV9.59.80.93142020-01-15
CVE-2022-21445 KEV9.59.80.92032022-04-19