Versions Compared

Old Version 2

changes.mady.by.user Izabela Jarosz

Saved on

compared with

New Version Current

changes.mady.by.user Izabela Jarosz

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Updates to Rules

New RulesUpdated Rules

Removed Rules

  • 50x
  • Microsoft Visual C++ 14.1
  • Microsoft Visual C++ 14.1 (x64)
  • Renesas RX C/C++ Compiler 2.5x
  • Vx-toolset for TriCore C/C++ Compiler 4.2

Deprecated Compilers

Support for the following compilers is deprecated and will be removed in future releases:

  • GNU GCC 7.x
  • GNU GCC 7.x (x86_64)
  • IAR Compiler for ARM v. 8.20x
  • IAR Compiler for ARM v. 8.22x
  • TI ARM C/C++ Compiler v18.1

  • TI ARM C/C++ Compiler GNU GCC 7.x

  • Wind River Clang 8.0.x

Removed Support for Compilers

The following compilers are no longer supported:

  • ARM Compiler 5.0
  • ARM Compiler 5.0 for uVision
  • ARM Compiler 6.9
  • Clang C/C++ Compiler v 8.0 (x86_64)
  • Clang C/C++ Compiler v 10.0 (x86_64)
  • GNU GCC 6.x
  • GNU GCC 6.x (x86_64)
  • Green Hills Software Compiler for ARM v. 2017.5.x
  • Green Hills Software Compiler for ARM64 v. 2017.5.x
  • Green Hills Software Compiler for PPC v. 2017.1.x
  • Hexagon Clang Compiler v. 8.4.x
  • IAR Compiler for ARM v. 8.11.x
  • QNX GCC 5.x
  • QNX GCC 5.x (ARM)
  • QNX GCC 5.x (ARM64)
  • QNX GCC 5.x (x86-64)

Deprecated Support for IDEs

Support for the following IDE is deprecated and will be removed in a future release:

  • Visual Studio 2017

Resolved Bugs and FRs

Scroll Ignore
scroll-pdftrue
scroll-officetrue
scroll-chmtrue
scroll-docbooktrue
scroll-eclipsehelptrue
scroll-epubtrue
scroll-htmltrue

This release includes the following enhancements:

Table of Contents
maxLevel1

Release Initial release date: November 27, 2025
Latest update: 2025.2.6 (August 28, 2026)

Enhanced Automotive Compliance Pack

  • This release introduces complete support for The MISRA C++ 2023 .1 coding guidelines.rules and test configuration have been updated to include the latest standard updates.

Enhanced Security Compliance Pack

Enhanced Static Analysis

  • New code analysis rules New test configurations have been added to extend coverage of compliance standards. See New Rulesfor the list of new rules.
  • Static analysis rules have been updated to increase the accuracy of reported violations. See Updated Rules for the list of updated rules.
  • based on the CWE Top 25 2024.
  • The CERT C/C++ rule severity levels have been updated based on the recent changes to the CERT risk assessment.

Enhanced Static Analysis

  • Initial support has been added for the static analysis of CUDA C/C++ code.
  • Flow Analysis has been enhanced to recognize Flow Analysis now understands the behavior of mathematical functions and uses , enabling it to compute results and determine more accurate constraints.

Enhanced Code Coverage

MCP Server Extension for LLM Agents

C/C++test now provides an MCP (Model Context Protocol) Server extension that allows you to smoothly integrate your LLM agents or applications (for example, Copilot) with
  • derive constraints with greater precision.
  • The code analysis engine has been enhanced to better support modern C/C++. 
  • The accuracy and performance of existing rules have been improved.
  • The presentation of rule categories in the Test Configuration Editor has been enhanced. See Static Tab Settings Defining How Static Analysis is Performed.

MCP Server Extension for AI Agents

test functionality. The C/C++test now includes an MCP Server can be integrated within any LLM-based development environment that supports MCP Server (Model Context Protocol) Server extension that enables seamless integration between C/C++test and AI agents or LLM-based coding assistants (such as GitHub Copilot). This MCP Server can be used within any LLM-enabled development environment that supports MCP integration, including Visual Studio and other environments. With  With this extension, an LLM  an AI agent can interact directly with C/C++test, providing delivering context-aware guidance, analysis, and analysisautomation. 

This feature allows you to use an AI copilot coding assistant to:

  • Access static analysis results to identify violations, prioritize critical issues based on your recommendations, and propose accurate fixes.
  • Interpret rules and documentation, enabling you to ask targeted questions, group or prioritize rules, and more easily customize static analysis configurations, reducing manual effort and ensuring alignment with your projects' internal quality standards.
  • Access information from the user guide to explain features and suggest resolutions for your issues.
  • Run static analysis and access static analysis results reported to the Problems view directly from Copilot Chat in VS Code.

For details, see For details, see Configuring the MCP Server Extension for LLM Agents.

Support for Compilers

The following compilers are now supported:

Compiler NameCompiler Identifier

Hexagon Clang Compiler v. 19*

hexagon-clang_19

IAR Compiler for RISC-V v. 3.30.x

iccriscv_3_30

NVIDIA CUDA Compiler 12.8*nvcc-gcc_12_8

QNX GCC 12.x (ARM64)

qccarm_12-64

TI ARM Clang Compiler 3.2

tiarmclang_3_2

* - Support for runtime analysis has been added.

** - Static analysis only.

See Compilers.

New and Updated Test Configurations

The following test configurations have been added:

  • CWE Top 25 2024
  • CWE Top 25 + On the Cusp 2024

The following test configurations have been updated with new rules:

The following test configurations have been removed:

  • CWE Top 25 2022
  • CWE Top 25 + On the Cusp 2022

Support for Platforms

The following platform is now supported:

Additional Updates

Deprecated and Removed Support

Deprecated Test Configurations

The following rule categories and corresponding built-in test configurations are deprecated and will be removed in a future release:

Deprecated Support for Operating Systems

Support for the following OS is now deprecated:

Compilers to Be Deprecated

Support for the following compilers will be deprecated in future releases:

  • ARM Compiler 6.14
  • Clang C/C++ Compiler v 12.0 (x86_64)
  • Clang C/C++ Compiler v 15.0 (x86_64)
  • Metaware DesignWare ARC C/C++ Compiler P-2019.09
  • GNU GCC 8.x (x86, x86_64, arm/aarch32, aarch64/arm64)
  • GNU GCC 9.x (x86, x86_64, arm/aarch32, aarch64/arm64)
  • Green Hills Software Compiler for PPC v. 2019.1.x
  • Hexagon Clang Compiler v. 8.6.x
  • HighTec GCC for Tricore 4.9.x
  • IAR Compiler for ARM v. 8.40x
  • IAR Compiler for ARM v. 8.50x
  • Microsoft Visual C++ 14.1
  • Microsoft Visual C++ 14.1 (x64)
  • Renesas RX C/C++ Compiler 2.5x
  • Vx-toolset for TriCore C/C++ Compiler 4.2

Deprecated Compilers

Support for the following compilers is deprecated and will be removed in future releases:

Enhanced Unit Testing and Code Coverage

  • HTML reports can now be generated with detailed information for multiple coverage metrics, including annotated source code. See "report.coverage_details_htmls" in Report Settings and "Generate detailed coverage reports for selected coverage types" in Execution Tab Settings Defining How Tests are Executed.
  • An option to use relative paths to instrumented objects in the linker command line has been added. The option reduces overall command-line length and helps avoid failures related to OS-imposed command-line limits. See LinkStep and LsiStep.
  • The code analysis engine has been enhanced to better support modern C/C++. 

Support for Compilers

The following compilers are now supported:

Compiler NameCompiler Identifier

Hexagon Clang Compiler v. 19*

hexagon-clang_19

IAR Compiler for RISC-V v. 3.30.x

iccriscv_3_30

NVIDIA CUDA Compiler 12.8**nvcc-gcc_12_8

QNX GCC 12.x (ARM64)

qccarm_12-64

TI ARM Clang Compiler 3.2

tiarmclang_3_2

* - Support for runtime analysis has been added.

** - Static analysis only.

See Compilers.

New and Updated Test Configurations

The following test configurations have been added:

  • CWE Top 25 2024
  • CWE Top 25 + On the Cusp 2024

The following test configurations have been updated with new rules:

  • AUTOSAR C++14 Coding Guidelines
  • High Integrity C++
  • MISRA C++ 2023
  • SEI CERT C Guidelines
  • SEI CERT C Rules

The following test configurations have been removed:

  • CWE Top 25 2022
  • CWE Top 25 + On the Cusp 2022

Additional Updates

Deprecated and Removed Support

Deprecated Support for Operating Systems

Support for the following OS is now deprecated:

  • Windows 10

Compilers to Be Deprecated

Support for the following compilers will be deprecated in future releases:

  • ARM Compiler 6.14
  • Clang C/C++ Compiler v 12.0 (x86_64)
  • Clang C/C++ Compiler v 15.0 (x86_64)
  • Metaware DesignWare ARC C/C++ Compiler P-2019.09
  • GNU GCC 8.x (x86, x86_64, arm/aarch32, aarch64/arm64)
  • GNU GCC 9.x (x86, x86_64, arm/aarch32, aarch64/arm64)
  • Green Hills Software Compiler for PPC v. 2019.1.x
  • Hexagon Clang Compiler v. 8.6.x
  • HighTec GCC for Tricore 4.9.x
  • GNU GCC 7.x
  • GNU GCC 7.x (x86_64)
  • IAR Compiler for ARM v. 8.20x40x
  • IAR Compiler for ARM v. 8.22x
  • TI ARM C/C++ Compiler v18.1

  • TI ARM C/C++ Compiler GNU GCC 7.x

  • Wind River Clang 8.0.x

Removed Support for Compilers

The following compilers are no longer supported:

  • ARM Compiler 5.0
  • ARM Compiler 5.0 for uVision
  • ARM Compiler 6.9
  • Clang C/C++ Compiler v 8.0 (x86_64)
  • Clang C/C++ Compiler v 10.0 (x86_64)
  • GNU GCC 6.x
  • GNU GCC 6.x (x86_64)
  • Green Hills Software Compiler for ARM v. 2017.5.x
  • Green Hills Software Compiler for ARM64 v. 2017.5.x
  • Green Hills Software Compiler for PPC v. 2017.1.x
  • Hexagon Clang Compiler v. 8.4.x
  • IAR Compiler for ARM v. 8.11.x
  • QNX GCC 5.x
  • QNX GCC 5.x (ARM)
  • QNX GCC 5.x (ARM64)
  • QNX GCC 5.x (x86-64)

Deprecated Support for IDEs

Support for the following IDE is deprecated and will be removed in a future release:

  • Visual Studio 2017

Resolved Bugs and FRs

Bug/FR ID

Description

Anchor
New RulesNew Rules

Rule ID

Header

Anchor
Updated RulesUpdated Rules

Category ID

Rule IDs

Bug/FR ID

Description

CPP-36270

[coverage] More than one coverage in detailed report for C/C++test Pro

CPP-52297

[compiler] Support for TI LLVM-based Clang Compiler (ARM CGT CLANG 3.2.2)

CPP-55820

[compiler] Support for Hexagon 19

CPP-56939

[static] Improve mapping for MISRACPP2023 Rule 8.2.2

CPP-58874 *

[stubs] QuickExecutionMode triggers Invalid stub configuration when using stub callbacks

CPP-59036

[engine] error: more than one instance of overloaded function

CPP-59050

[compiler] Support for QNX GCC 12.x

CPP-59081

[static] AUTOSAR-A18_9_2-b (CODSTA-MCPP-13_d) reports false positive when rvalue reference is passed as an argument to function

CPP-59175

[engine] static assertion failed with "abi not configured"

CPP-59189

[static] GLOBAL-UNUSEDTYPE (MISRA2008-0_1_5) reports false positive on scoped enum type used in a case label

CPP-59194

[static] CODSTA-223_c (MISRACPP2023-6_9_2-a) reports false positive on the first parameter of the 'main' function if its name is not 'argc'

CPP-59201

[engine] "static assertion failed" during instrumentation

CPP-59574

[engine] error: no instance of constructor "google::protobuf::internal::InternalMetadata::Container<google::protobuf::UnknownFieldSet>::Container" matches the argument list

CPP-59575

[static] TEMPL-12 (MISRACPP2023-6_4_3-a) reports false positive on implicitly generated variable in a 'for-range' loop

CPP-59581

[static] CODSTA-CPP-110 (MISRACPP2023-6_4_1-f) reports a false positive when a derived class member is used in a base class

CPP-59607

[engine] static analysis fails with invalid type conversion

CPP-59614

[engine] cwc exit code 3: "expression must have a constant value" with Hexagon

CPP-59616

[engine] error: a class or namespace qualified name is required

CPP-59629

[static] MISRA2004-5_2_b reports false positive violation when a variable is declared in init-statement of 'if'

CPP-59634

[engine] Parse error for generated Google Protocol Buffers header

CPP-59638

[engine] error: the default constructor of "std::basic_format_arg<std::format_context>" cannot be referenced

CPP-59640

[docs] Description of the Verbosity tab in the flow analysis of the User Guide is incorrect.

CPP-59649

[static] Improve performance of COMPATDECLS and EXCSPECDECL global rules.

CPP-59651

[static] False positives with rule CODSTA-303 (MISRACPP2023-6_4_1-g)

CPP-59684

[coverage] Improve coverage instrumentation for C99 _Generic selection

CPP-59695

[engine] Parse error: function cannot be referenced - it is a deleted function

CPP-59719

[compiler] Support for IAR Compiler for RISC-V v.3.30

CPP-59737

[static] Add parameter in CODSTA-CPP-211 and CODSTA-316 rules for cast to void type

CPP-59742

[engine] error: the default constructor of "std::basic_format_arg<std::format_context>" cannot be referenced

CPP-59745

[static] Improve RW implementation of rule FORMAT-33

CPP-59754

[engine] Class template is not compatible with template template parameter

CPP-59755

[engine] Program received signal 11 when instrumenting with cpptestcc

CPP-59760

[static] Improve performance of HICPP-7_1_3-a rule

CPP-59761

[engine] Instrumentation fails once all template instantiations are provided

CPP-59777

[engine] parser performance problem during SCA

CPP-59778

[static] Extend MISRA2004-12_2_b to detect use of std::move() in function arguments

CPP-59801

[engine] invalid alignment value specified by attribute - aligned(0x100000)

CPP-59802

[static] Rule MISRACPP2023-15_1_4-a reports on a variable which does not exist in the class

CPP-59803

[static] CODSTA-67_b (MISRACPP2023-6_9_1-a) reports false positive on parameters of template functions

CPP-59809

[engine] Instrumentation compilation error: error C2653: ... is not a class or namespace name

CPP-60123

[engine][rw] Improve getMemberVariables function for static member variables with initializers

CPP-60149

[engine] error: no instance of "toDicom" matches the argument list

CPP-60188

[compiler] Add/improve support for -Wc/-Wp option prefixes for QCC compiler

CPP-60190

[static] Improve performance of MISRA2004-2_4 rule

CPP-60191

[engine] error: more than one instance of overloaded function

CPP-60200

[engine] Missing support for __is_bitwise_cloneable

CPP-60207

[engine] error: class type not suitable for use with designators

CPP-60208

[static] Improve CODSTA-MCPP-04 (MISRACPP2023-7_11_1-a, AUTOSAR-A4_10_1-b) support for C++20 comparison operators

CPP-60212

[engine] Instrumentation [xharness] crashes with signal 11

CPP-60216

[static] False positive for MISRACPP2023-7_0_1-a using std::atomic_bool

CPP-60219

[static] RuleWizard rules should not analyze template instances outside of the testing scope

CPP-60242

[compiler] Dependencies for temporary files injected by cpptestcc into QNX qcc build

CPP-60252

[static] MISRA2004-12_4_a (MISRACPP2023-8_14_1) reports false positive when functions without side effects are called in rhs operand

CPP-60282

[engine] instrumentation compilation error: conversion from AbstractProperty to char is ambiguous

CPP-60283

[compiler] Improve support for iccarm 9.50 builtin functions (__iar_atomic_store and __iar_atomic_load)

CPP-60291

[static] Improve performance of INIT-16 rule

CPP-60324

[static] PB-69 reports python errors when a member of pointer type is initialized by aggregate initializer

CPP-60338

[engine] Class has no member "space_ship" parse errors

CPP-60341

[static] STL-14 (MISRACPP2023-26_3_1-a) reports false positive on vector<bool> that is not from 'std'

CPP-60357

[static] Update MISRA C++ Rule 7.0.1

CPP-60358

[static] Update MISRA C++ Rule 7.0.3

CPP-60374

[engine] internal error: assertion failed at: "lower_name.c", line 2703 in mangled_encoding_for_template_parameter

CPP-60391

[engine] parse error: no instance of constructor...

CPP-60399

[static] CODSTA-CPP-112 (MISRACPP2023-28_6_4-a) reports false positive on a call to the 'std::filesystem::remove'

CPP-60400

[engine] Instrumentation compilation error: the value of '__CPTR_cui_4079667399_95697_12962959' is not usable in a constant expression

CPP-60402

[engine] error: constexpr constructor must initialize direct base class

CPP-60410

[compiler] qccarm_8-64 compiler still uses -lang-c even though it is deprecated

CPP-60476

[engine] Segmentation fault when running google tests with cpptestcc

CPP-60477

[static] INIT-03 false positive using alignof(U) where U is a type derived from the template parameter T to assign to an auto variable

CPP-60488

[compiler] ccac_2019_09 compiler configuration rejects command lines with -MF option

CPP-60510

[static] TEMPL-12 (MISRACPP2023-6_4_3-a) reports false positive when a class inherits from non-dependent template base class

CPP-60520

[engine] EDG parser crash

CPP-60547

[static] MISRA-023 (MISRACPP2023-6_5_1-a) hangs (timeout after 1h) on specific code

CPP-60548

[engine] Parse error - incompatible declaration

CPP-60557

[engine] internal error: assertion failed at: "lower_name.c", line 2703 in mangled_encoding_for_template_parameter

CPP-60564

[engine] error: function cannot be referenced – it is a deleted function

CPP-60668

[coverage] Improve collecting coverage for C++ templates with std::enable_if in template parameters

CPP-60672

[engine] error: declaration is incompatible

CPP-60689

[static] CODSTA-187_a (CERT_C-STR34-b) reports false positive when integer literal with digit separator is used

CPP-60703

[static] false positive of rule CODSTA-303 (MISRACPP2023-6_4_1-g)

CPP-60705

[static] Improve accuracy of CODSTA-CPP-206 (MISRACPP2023-6_8_4-a) on r-value references

CPP-60790

[engine] error: a constexpr function cannot have a nonliteral return type

CPP-60842

[coverage] Coverage not collected for lambda used to initialize field directly in class

FA-9907

BD-PB-VARARGS False Positive with MSVC

FA-9815

BD-API-VALPARAM false positive when math functions used

FA-9999

CERT_C-FLP32-a / BD-API-VALPARAM: Flow Analysis does not recognize that sin(x)<=1

FA-10295

MISRACPP2023-28_6_3-b(BD-PB-SUBSEQMOVE) potential false positive

FA-10306

MISRACPP2023-11_6_2-a-1(BD-PB-NOTINIT) false positive for object with all fields initialized

FA-10328

BD-PB-VOVR (MISRACPP2023-0_1_1-a): False positive for range-based loops

FA-10359

MISRACPP2023-11_6_2-a (BD-PB-NOTINIT) False Positive

FA-10380

BD-PB-NOTINIT (MISRACPP2023-11_6_2-a) reports violation on partially-initialized value

FA-10397

False positive of MISRACPP2023-11_6_2-a (BD-PB-NOTINIT)

FA-10370

Loss of object knowledge during copy

FA-10407

MISRACPP2023-11_6_2-a-1 (BD-PB-NOTINIT with "Report when partially-initialized object is copied" param enabled) false positive

FA-10415

Caching issue rule MISRACPP2023-0_2_4 (BD-PB-UCMETH)

FA-10416

MISRACPP2023-11_6_2-a-1 (BD-PB-NOTINIT with "Report when partially-initialized object is copied" param enabled) false positive for anonymous union

FA-10417

MISRACPP2023-11_6_2-a-1 (BD-PB-NOTINIT with "Report when partially-initialized object is copied" param enabled) false positive for array field

FA-10447

BD-PB-NP false positive violations on realloc

PT-3184 *

[VS] Rule tree operations may freeze the Visual Studio IDE

PT-3214 *

Mismatch Between CSV File Displayed Encoding Setting and Behavior

PT-3264 *

[VS] Loading coverage data during start-up may crash Visual Studio IDE 2022

* Resolved in 2025.2.1

Updates to Rules

Anchor
New Rules
New Rules
New Rules

Rule ID

Header

AUTOSAR-A18_9_2-c

The 'std::forward' function should only be used to forward forwarding references

AUTOSAR-A7_1_8-b

A non-type specifier should be placed before a type specifier in a declaration

CODSTA-117_b

Universal character name shall be terminated

CODSTA-78_b

A goto statement should reference a label directly enclosed in a statement that encloses this goto

CODSTA-CPP-114

A non-type specifier should be placed before a type specifier in a declaration

CODSTA-CPP-66_b

C-style casts (other than 'void' casts) and functional notation casts (other than explicit constructor calls) should not be used

CWE-74-a

Protect against command injection

CWE-74-b

Protect against environment injection

CWE-74-c

Protect against file name injection

CWE-74-d

Protect against SQL injection

MISRACPP2023-21_6_2-d

The memory management functions 'std::get_temporary_buffer' and 'std::return_temporary_buffer' should not be used

MISRACPP2023-21_6_3-e

The memory management functions 'std::get_temporary_buffer' and 'std::return_temporary_buffer' should not be used

MISRACPP2023-5_13_2-b

Universal character name shall be terminated

MISRACPP2023-8_2_2-b

C-style casts (other than 'void' casts) and functional notation casts (other than explicit constructor calls) should not be used

MISRACPP2023-9_6_2-b

A goto statement should reference a label directly enclosed in a statement that encloses this goto

MRM-63

The memory management functions 'std::get_temporary_buffer' and 'std::return_temporary_buffer' should not be used

Anchor
Updated Rules
Updated Rules
Updated Rules

Category ID

Rule IDs

AUTOSAR C++14 Coding Guidelines

AUTOSAR-A0_1_1-a, AUTOSAR-A0_1_6-a, AUTOSAR-A0_4_4-a, AUTOSAR-A12_8_3-a, AUTOSAR-A18_1_2-a, AUTOSAR-A18_9_1-a, AUTOSAR-A1_1_1-e, AUTOSAR-A26_5_2-a, AUTOSAR-A27_0_1-b, AUTOSAR-A27_0_1-c, AUTOSAR-A27_0_1-d, AUTOSAR-A27_0_1-e, AUTOSAR-A27_0_1-f, AUTOSAR-A27_0_1-g, AUTOSAR-A27_0_1-h, AUTOSAR-A27_0_2-e, AUTOSAR-A27_0_2-f, AUTOSAR-A2_7_2-a, AUTOSAR-A4_10_1-b, AUTOSAR-A5_2_5-d, AUTOSAR-A5_3_2-a, AUTOSAR-A7_1_7-c, AUTOSAR-A8_5_0-a, AUTOSAR-M0_3_1-f, AUTOSAR-M14_6_1-a, AUTOSAR-M7_3_1-a, AUTOSAR-M8_0_1-a, AUTOSAR-M8_4_2-a

Coding Conventions for C++

CODSTA-CPP-112, CODSTA-CPP-205, CODSTA-CPP-206, CODSTA-CPP-211, CODSTA-CPP-212, CODSTA-CPP-36, CODSTA-CPP-66

Coding Conventions for Modern C++

CODSTA-MCPP-04, CODSTA-MCPP-07, CODSTA-MCPP-10_b

Coding Conventions

CODSTA-04, CODSTA-117, CODSTA-187_a, CODSTA-223_c, CODSTA-235, CODSTA-238, CODSTA-242, CODSTA-303, CODSTA-312, CODSTA-315, CODSTA-316, CODSTA-67_b

Common Weakness Enumeration

CWE-119-f, CWE-119-g, CWE-119-h, CWE-119-i, CWE-121-f, CWE-121-g, CWE-121-h, CWE-121-i, CWE-122-f, CWE-122-g, CWE-122-h, CWE-122-i, CWE-124-e, CWE-124-f, CWE-124-g, CWE-125-d, CWE-125-e, CWE-126-e, CWE-126-f, CWE-127-e, CWE-127-f, CWE-134-a, CWE-190-k, CWE-191-k, CWE-195-a, CWE-20-a, CWE-20-b, CWE-20-c, CWE-20-d, CWE-20-e, CWE-20-f, CWE-20-g, CWE-20-h, CWE-20-i, CWE-22-a, CWE-23-a, CWE-244-a, CWE-312-a, CWE-36-a, CWE-400-b, CWE-427-b, CWE-457-a, CWE-476-a, CWE-506-a, CWE-526-a, CWE-532-a, CWE-534-a, CWE-535-a, CWE-563-a, CWE-591-a, CWE-606-a, CWE-611-a, CWE-668-a, CWE-690-a, CWE-758-a, CWE-77-a, CWE-770-a, CWE-78-a, CWE-787-e, CWE-787-f, CWE-787-h, CWE-789-a, CWE-89-a

DISA ASD STIG

APSC_DV-000480-a, APSC_DV-001290-a, APSC_DV-001300-a, APSC_DV-001740-a, APSC_DV-001750-a, APSC_DV-001850-a, APSC_DV-002050-c, APSC_DV-002290-b, APSC_DV-002390-a, APSC_DV-002400-a, APSC_DV-002440-a, APSC_DV-002460-a, APSC_DV-002470-a, APSC_DV-002510-a, APSC_DV-002520-a, APSC_DV-002520-b, APSC_DV-002520-c, APSC_DV-002520-e, APSC_DV-002520-f, APSC_DV-002520-g, APSC_DV-002520-h, APSC_DV-002520-i, APSC_DV-002520-j, APSC_DV-002530-a, APSC_DV-002530-b, APSC_DV-002530-c, APSC_DV-002530-e, APSC_DV-002530-f, APSC_DV-002530-g, APSC_DV-002530-h, APSC_DV-002530-i, APSC_DV-002530-j, APSC_DV-002540-a, APSC_DV-002550-a, APSC_DV-002550-b, APSC_DV-002550-c, APSC_DV-002550-e, APSC_DV-002550-f, APSC_DV-002550-g, APSC_DV-002550-h, APSC_DV-002550-i, APSC_DV-002550-j, APSC_DV-002560-a, APSC_DV-002560-b, APSC_DV-002560-c, APSC_DV-002560-e, APSC_DV-002560-f, APSC_DV-002560-g, APSC_DV-002560-h, APSC_DV-002560-i, APSC_DV-002560-j, APSC_DV-002570-a, APSC_DV-002580-a, APSC_DV-002590-f, APSC_DV-002590-g, APSC_DV-002590-h, APSC_DV-002590-i, APSC_DV-002590-j, APSC_DV-003120-a, APSC_DV-003320-c, APSC_DV-003320-d

Flow Analysis

BD-API-VALPARAM, BD-PB-NOTINIT, BD-PB-NP, BD-PB-SUBSEQMOVE, BD-PB-VARARGS, BD-PB-VOVR, BD-SECURITY-ARRAY, BD-SECURITY-BUFWRITE, BD-SECURITY-INTOVERF, BD-SECURITY-LOG, BD-SECURITY-OVERFFMT, BD-SECURITY-OVERFRD, BD-SECURITY-OVERFWR, BD-SECURITY-RAND, BD-SECURITY-SENSFREE, BD-SECURITY-SENSLOG, BD-SECURITY-TDALLOC, BD-SECURITY-TDCMD, BD-SECURITY-TDCONSOLE, BD-SECURITY-TDENV, BD-SECURITY-TDFNAMES, BD-SECURITY-TDINPUT, BD-SECURITY-TDINTOVERF, BD-SECURITY-TDLOOP, BD-SECURITY-TDSQL, BD-SECURITY-XXEXRC

Formatting

FORMAT-09, FORMAT-10, FORMAT-33

Global Static Analysis

GLOBAL-UNUSEDTYPE

High Integrity C++

HICPP-17_1_1-a, HICPP-2_5_3-a, HICPP-5_2_1-c, HICPP-7_1_1-b, HICPP-7_1_3-a, HICPP-7_1_3-a, HICPP-7_1_6-b, HICPP-8_2_1-a, HICPP-8_4_1-a

Initialization

INIT-03

Joint Strike Fighter

JSF-098, JSF-105, JSF-127, JSF-138_a, JSF-142_b, JSF-185

MISRA C 1998

MISRA-024

MISRA C 2004

MISRA2004-12_2-b, MISRA2004-12_4-a, MISRA2004-16_4, MISRA2004-2_4, MISRA2004-5_2-b

MISRA C 2012 (Legacy)

MISRA2012-DIR-4_11, MISRA2012-DIR-4_14_a, MISRA2012-DIR-4_14_b, MISRA2012-DIR-4_14_c, MISRA2012-DIR-4_14_d, MISRA2012-DIR-4_14_e, MISRA2012-DIR-4_14_f, MISRA2012-DIR-4_14_g, MISRA2012-DIR-4_14_h, MISRA2012-DIR-4_14_i, MISRA2012-DIR-4_14_j, MISRA2012-DIR-4_14_k, MISRA2012-DIR-4_14_l, MISRA2012-DIR-4_1_b, MISRA2012-DIR-4_4, MISRA2012-RULE-1_3_b, MISRA2012-RULE-2_2_b, MISRA2012-RULE-4_1, MISRA2012-RULE-8_3_b, MISRA2012-RULE-9_1, MISRA2012-RULE-9_4

MISRA C 2023 (MISRA C 2012)

MISRAC2012-DIR_4_1-b, MISRAC2012-DIR_4_11-a, MISRAC2012-DIR_4_14-a, MISRAC2012-DIR_4_14-b, MISRAC2012-DIR_4_14-c, MISRAC2012-DIR_4_14-d, MISRAC2012-DIR_4_14-e, MISRAC2012-DIR_4_14-f, MISRAC2012-DIR_4_14-g, MISRAC2012-DIR_4_14-h, MISRAC2012-DIR_4_14-i, MISRAC2012-DIR_4_14-j, MISRAC2012-DIR_4_14-k, MISRAC2012-DIR_4_14-l, MISRAC2012-DIR_4_4-a, MISRAC2012-RULE-2_2-b, MISRAC2012-RULE-9_1-a, MISRAC2012-RULE_1_3-b, MISRAC2012-RULE_2_2-b, MISRAC2012-RULE_4_1-a, MISRAC2012-RULE_8_3-b, MISRAC2012-RULE_9_1-a, MISRAC2012-RULE_9_4-a

MISRA C 2025

MISRAC2025-DIR_4_1-b, MISRAC2025-DIR_4_11-a, MISRAC2025-DIR_4_14-a, MISRAC2025-DIR_4_14-b, MISRAC2025-DIR_4_14-c, MISRAC2025-DIR_4_14-d, MISRAC2025-DIR_4_14-e, MISRAC2025-DIR_4_14-f, MISRAC2025-DIR_4_14-g, MISRAC2025-DIR_4_14-h, MISRAC2025-DIR_4_14-i, MISRAC2025-DIR_4_14-j, MISRAC2025-DIR_4_14-k, MISRAC2025-DIR_4_14-l, MISRAC2025-DIR_4_4-a, MISRAC2025-RULE_1_3-b, MISRAC2025-RULE_2_2-b, MISRAC2025-RULE_4_1-a, MISRAC2025-RULE_8_3-b, MISRAC2025-RULE_9_1-a, MISRAC2025-RULE_9_4-a

MISRA C++ 2008

MISRA2008-0_1_5, MISRA2008-0_1_6, MISRA2008-0_3_1_b, MISRA2008-14_6_1, MISRA2008-2_7_2, MISRA2008-2_7_3, MISRA2008-5_2_4, MISRA2008-7_3_1, MISRA2008-8_0_1, MISRA2008-8_4_2

MISRA C++ 2023

MISRACPP2023-0_1_1-a, MISRACPP2023-10_0_1-a, MISRACPP2023-11_6_2-a, MISRACPP2023-13_3_3-a, MISRACPP2023-15_0_2-a, MISRACPP2023-21_2_2-a, MISRACPP2023-24_5_2-a, MISRACPP2023-26_3_1-a, MISRACPP2023-28_6_3-b, MISRACPP2023-28_6_4-a, MISRACPP2023-4_1_3-c, MISRACPP2023-5_13_2-a, MISRACPP2023-5_7_2-a, MISRACPP2023-6_0_3-a, MISRACPP2023-6_4_1-g, MISRACPP2023-6_4_3-a, MISRACPP2023-6_5_2-b, MISRACPP2023-6_7_1-a, MISRACPP2023-6_8_4-a, MISRACPP2023-6_9_1-a, MISRACPP2023-6_9_2-a, MISRACPP2023-7_0_1-a, MISRACPP2023-7_0_2-a, MISRACPP2023-7_0_3-a, MISRACPP2023-7_0_6-a, MISRACPP2023-7_11_1-a, MISRACPP2023-9_5_1-a

Naming Conventions

NAMING-34

OWASP API Security Top 10 (2019)

OWASP2019-API3-h, OWASP2019-API3-i, OWASP2019-API3-j, OWASP2019-API3-k, OWASP2019-API3-l, OWASP2019-API4-a, OWASP2019-API8-a, OWASP2019-API8-b, OWASP2019-API8-c, OWASP2019-API8-d, OWASP2019-API8-e, OWASP2019-API8-f, OWASP2019-API8-g

OWASP API Security Top 10 (2023)

OWASP2023-API10-a, OWASP2023-API10-b, OWASP2023-API10-c, OWASP2023-API10-d, OWASP2023-API10-e, OWASP2023-API10-f, OWASP2023-API10-g, OWASP2023-API10-h, OWASP2023-API10-i, OWASP2023-API3-a, OWASP2023-API3-b, OWASP2023-API4-a, OWASP2023-API4-b

OWASP Top 10 (2017)

OWASP2017-A1-a, OWASP2017-A1-b, OWASP2017-A1-c, OWASP2017-A1-d, OWASP2017-A1-e, OWASP2017-A1-f, OWASP2017-A3-a, OWASP2017-A4-a, OWASP2017-A5-a

OWASP Top 10 (2021)

OWASP2021-A1-a, OWASP2021-A2-a, OWASP2021-A3-a, OWASP2021-A3-b, OWASP2021-A3-c, OWASP2021-A3-d, OWASP2021-A3-e, OWASP2021-A3-f, OWASP2021-A4-a, OWASP2021-A5-d

Possible Bugs

PB-69

SEI CERT C++

CERT_CPP-EXP53-a, CERT_CPP-EXP58-a, CERT_CPP-EXP63-a, CERT_CPP-MSC51-a, CERT_CPP-STR50-e, CERT_CPP-STR50-f, CERT_CPP-STR51-a

SEI CERT C

CERT_C-DCL04-a, CERT_C-DCL18-a, CERT_C-DCL22-a, CERT_C-DCL36-a, CERT_C-ERR07-b, CERT_C-EXP33-a, CERT_C-EXP34-a, CERT_C-EXP39-d, CERT_C-EXP39-e, CERT_C-EXP39-f, CERT_C-FIO32-a, CERT_C-FLP32-a, CERT_C-INT04-a, CERT_C-INT04-b, CERT_C-INT04-c, CERT_C-MEM03-a, CERT_C-MSC19-b, CERT_C-MSC32-d, CERT_C-MSC39-a, CERT_C-STR02-a, CERT_C-STR02-b, CERT_C-STR02-c, CERT_C-STR31-c, CERT_C-STR31-d, CERT_C-STR34-b

STL Best Practices

STL-14

Template

TEMPL-12

Removed Rules

Rule ID

Notes

AUTOSAR-A18_9_2-b

Removed from AUTOSAR C++ 14 configuration. For other configurations, CODSTA-MCPP-13_d can be used instead.

AUTOSAR-A7_1_8-a

Removed from AUTOSAR C++ 14 configuration. For other configurations, CODSTA-CPP-114 can be used instead.

CERT_C-POS33-a

Removed from SEI CERT C configuration. For other configurations, SECURITY-10 can be used instead.

CERT_C-STR07-a

Removed from SEI CERT C configuration. For other configurations, SECURITY-13 can be used instead.

HICPP-7_3_2-c

Removed from High Integrity C++ configuration. For other configurations, CODSTA-MCPP-13_d can be used instead.

MISRACPP2023-8_2_2-a

Removed from MISRA C++ 2023 configuration. For other configurations, CODSTA-CPP-66 can be used instead.

MISRACPP2023-9_6_2-a

Removed from MISRA C++ 2023 configuration. For other configurations, CODSTA-78 can be used instead.

Resolved Bugs and FRs in 2025.2.6

Bug/FR ID

Description

CVE-2026-8763
CVE-2026-58062

Critical vulnerabilities resolved by upgrading bc-fips to 2.1.3

CVE-2026-59638

Critical vulnerability resolved by upgrading bctls-fips to 2.1.24

Rule ID

Notes

Scroll Only

For information about this release, see https://docs.parasoft.com/display/CPPTESTPROVS20252/Updates+in+2025.2.