CWE-1284 describes a weakness where software accepts a quantity-like input without validating it properly before using it. The value may be a length, count, size, index, or packet field. If the program trusts that number, it can allocate too little memory, process too much data, misroute logic, or enter an error state. In security terms, this is a classic input-validation failure.
This weakness matters because attackers often control the numbers carried inside network messages, API requests, or device commands. In real attacks, a crafted packet with an unexpected count or size can trigger crashes, denial of service, or broken protocol handling. Defenders reduce risk by enforcing strict bounds, rejecting malformed values early, using safe parsing routines, and testing edge cases such as zero, negative, and oversized quantities. In industrial systems, where timing and availability are critical, a bad quantity check can disrupt communications even without code execution or data theft.