The CWE Top 25 is calculated by examining the available root cause mapping data within publicly available CVE Record information. Thus, the more CNAs that adopt CWE mapping as part of their vulnerability disclosure, and the more specific they are in their mappings, the more specific and valuable the Top 25 will be.

Source: Help Net Security