Researchers find half of NVD's CWE labels don't match code

CWEAgent audited 15,556 open-source CVEs disclosed from 2017 through 2026, matching just 49.70% of NVD's CWE labels to code-grounded ones, per a CWEAgent audit posted to arXiv.

Every scanner evaluation and machine learning tool that treats NVD's CWE field as ground truth inherits that gap. Reliability varies sharply by which organization assigned the CVE and what kind of weakness is involved.

On a curated 100-CVE benchmark, CWEAgent reached 85% top-1 accuracy. It uses a structured representation built to capture root cause, trigger condition, violated property, exploit mechanism, and impact. Across the full 15,556-CVE set, agreement with NVD's labels was just 49.70%.

At the larger 15,556-CVE scale, 31.37% of the mismatches are defensible under CWE's own taxonomy ambiguity. More than one label can reasonably apply to the same flaw. The remaining 3.63% look like outright errors, not disagreements about interpretation.

That gap concentrates in weakness types where the taxonomy itself is still contested.