The software uses low-level functionality that is explicitly prohibited by the framework or specification under which the software is supposed to operate.The use of low-level functionality can violate the specification in unexpected ways that effectively disable built-in protection mechanisms, introduce exploitable inconsistencies, or otherwise expose the functionality to attack.