CAPEC-456
Infected Memory
An adversary inserts malicious logic into memory enabling them to achieve a negative impact. This logic is often hidden from the user of the system and works behind the scenes to achieve negative impacts. This pattern of attack focuses on systems already fielded and used in operation as opposed to systems that are still under development and part of the supply chain.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-456: Infected Memory: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/456.html and https://cve.bz/cve/capec/456?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Execute Unauthorized Commands | Authorization |
Mitigations
Leverage anti-virus products to detect stop operations with known virus.
Weaknesses it exploits
- CWE-1257 Improper Access Control Applied to Mirrored or Aliased Memory Regions
- CWE-1260 Improper Handling of Overlap Between Protected Memory Ranges
- CWE-1274 Improper Access Control for Volatile Memory Containing Boot Code
- CWE-1312 Missing Protection for Mirrored Regions in On-Chip Fabric Firewall
- CWE-1316 Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
Recent CVEs with these weaknesses
- 6.3CVE-2026-76668
A security vulnerability in HPE NonStop Kernel may allow user space access to privileged or unmapped data.
- 6.8CVE-2026-20760
Improper handling of overlap between protected memory ranges in some microcode for some Intel(R) Processors within Ring 0: Hypervisor may allow an escalation of privilege. Authorized adversary with a privileged user combined with a low com…
- 7.0CVE-2025-31936
Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processors when using Intel(R) TDX within SMM may allow an escalation of privilege. SMM adversary with a privileged user combined with a high complexi…
- 4.6CVE-2024-36345
Improper input validation in the AMD OverDrive (AOD) System Management Mode (SMM) module could allow a privileged attacker to perform an out-of-bounds read, potentially resulting in loss of confidentiality.
- 6.9CVE-2018-25244
Eco Search 1.0.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 950 or more characters…
- 6.9CVE-2018-25240
Watchr 1.1.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 8145 characters into the s…
- 6.9CVE-2018-25238
VSCO 1.1.1.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string through the search functionality. Attackers can paste a buffer of 5000 characters into th…
- 6.9CVE-2019-25655
Device Monitoring Studio 8.10.00.8925 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string to the server connection dialog. Attackers can trigger the crash …
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-441 Malicious Logic Insertion
Examples
A USB Memory stick has malicious logic inserted before shipping of the product allowing for infection of the …
A USB Memory stick has malicious logic inserted before shipping of the product allowing for infection of the host machine once inserted into the USB port.
In 2007, approximately 1800 of Seagate's Maxtor Personal Storage 3200 drives were built under contract with a…
In 2007, approximately 1800 of Seagate's Maxtor Personal Storage 3200 drives were built under contract with an outside manufacturer and contained a virus that stole user passwords.
MITRE's words, unchanged: CAPEC-456 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.