Polyspace Support of CWE Rules and Categories
R2026bCommon Weakness Enumeration (CWE™) is a list of software weakness types that can occur in software architecture, design, code, or implementation. These weaknesses can lead to security vulnerabilities.
Polyspace can check your code against subsets of the CWE list including subsets or weaknesses that are specific to C or C++ code. To activate subsets of the CWE list, use the analysis option -cwe
Supported CWE Rules
Weaknesses specified in the Common Weakness Enumeration (CWE) include issues that can be checked exactly by Polyspace®. Polyspace can detect all violations of these CWE rules specified in the standard. In addition to these exact checkers, Polyspace provides partial support for other CWE rules. When checking for violations of CWE rules, you can choose to enable:
All supported CWE rules
Only the exact CWE rules
Rules from the CWE 658 category
Rules from the CWE 659 category
To look up all supported CWE rules, see Common Weakness Enumeration (CWE).
To lookup the exact checkers:
On the Configuration node in your project configuration, locate Static Analysis tab.
In Defects and Coding Standards, select
Use custom checkers file.Open the Checkers Selection dialog box by clicking Open (
).In the Checkers Selection window, click New to create a new checkers file. Clear the coding rules that are already selected.
Select CWE in the list of coding standards and defects.
Select the checkbox all-exact-checkers. The exact CWE coding rule checkers are selected.
Save your selection as an XML file.
Supported CWE Categories
CWE rules are organized into categories of related issues. The categories themselves are not weaknesses but help organize the results around specific types of weaknesses. For example, CWE 310 is the category Cryptographic issues which collects the cryptography related CWE rules. After you run a Polyspace Bug Finder™ analysis, use the CWE categories to group and organize the CWE violations in your code by type of issue.
This table lists CWE categories that you can map to Polyspace defect checkers and Polyspace CWE coding rule checkers.
CWE and DO Qualification or IEC Certification Kits
CWE (Common Weakness Enumeration) is a community-driven list of software weaknesses, but it is not an official standard and does not meet the criteria for formal certification.
The following points explain why CWE checkers are not included in the DO qualification kit nor in IEC certification kits:
Not an official standard — CWE is a reference list maintained by MITRE, not a recognized standard by certification authorities.
No versioning — CWE entries are updated without formal version control, making traceability and compliance difficult.
Language independent requirements — CWE requirements are generic and not specific to C/C++, which limits their applicability in language-specific certification contexts.
Polyspace-specific implementation — CWE does not provide strict definitions of what must be checked, requiring interpretation of the underlying weakness. Polyspace checkers are designed based on these interpretations and may not fully map to CWE requirements, which prevents strict alignment with certification criteria.
Therefore, CWE checkers in Polyspace serve as additional security analysis tools but are not included in any official DO qualification or IEC certification kits.
