CVE

Every computer program contains bugs. Some of these bugs are harmless, others allow attackers to take over foreign devices or steal data. Such dangerous bugs are called security vulnerabilities. So that everyone worldwide can talk about the same vulnerability, each one gets its own number. This numbering system is called CVE, short for Common Vulnerabilities and Exposures. Such a number looks like this: CVE-2024-3094. The first number is the year, the second a running number.

Why a number is worth more than a name

Without uniform numbers, chaos reigns. One manufacturer calls the same vulnerability a “bug in the login module,” a security firm calls it “Bug 4711,” a newspaper writes about the “password leak.” No one knows whether these are three problems or one. With a CVE number, the matter is unambiguously settled.

This is not just convenient, it is practically necessary. Large companies operate thousands of servers with hundreds of programs. Their scanning tools automatically check which software is installed and compare it against lists of known CVE numbers. If a number matches an installed version, the tool flags a need for action. Without shared identifiers, no program could perform this matching automatically.

The system is also important for the public. Authorities such as the German Federal Office for Information Security issue warnings citing the CVE number. Anyone can then look up for themselves which programs are affected. By now, well over 25,000 new entries are added per year. Without an ordering system, this volume would be unmanageable.

From discovery to entry in the list

At the start there is someone who discovers the vulnerability: a researcher, an employee of the manufacturer, or an attentive user. The discovery is passed to a so-called CVE Numbering Authority, CNA for short. These are officially authorized bodies permitted to assign numbers. They include large software companies such as Microsoft or Google, but also government institutions. The assignment of numbers is coordinated by the US organization MITRE.

The authority reviews the report and reserves a number. The entry is usually only published later. It is customary to first give the manufacturer time for a fix. This fix is called a patch, i.e. an update that closes the flaw. Only once the patch is available do the details go public.

A common misconception: the CVE number says nothing about how dangerous a vulnerability is. It is purely bookkeeping, comparable to a case number at a court. How severe a vulnerability is gets assessed by a separate scoring system called CVSS. It assigns values from 0 to 10. From around 9 upward, a vulnerability is considered critical and should be fixed immediately.

CVE numbers in headlines and everyday work

Whenever a major security vulnerability makes the news, the number appears in the text. The best-known example is CVE-2021-44228, better known as Log4Shell. The flaw was located in a tiny component used in the background by countless programs. IT departments worldwide worked over Christmas to close the vulnerability.

Even without an IT job, one encounters the system. The update notes for Windows, Android, or the browser often list the CVE numbers that have been closed. That is the reason why updates are annoying but sensible: they close exactly these documented vulnerabilities.

For AI systems, this topic is becoming increasingly relevant. Libraries for machine learning also receive CVE entries, for instance when a manipulated model can execute foreign program code upon loading. At the same time, AI tools help to automatically search program code for possible vulnerabilities. The number of reported entries is likely to keep rising as a result.