cve.bz

CWE-664: Improper Control of a Resource Through its Lifetime

Filter

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

What the weakness is: CWE-664 at MITRE. All weaknesses

Related attack patterns (CAPEC): 5
  • CAPEC-21 Exploitation of Trusted Identifiers Likelihood: High · Severity: High
  • CAPEC-60 Reusing Session IDs (aka Session Replay) Likelihood: High · Severity: High
  • CAPEC-61 Session Fixation Likelihood: Medium · Severity: High
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-196 Session Credential Falsification through Forging Likelihood: Medium · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-664, as MITRE names them. Credits.

Ask an AI about CWE-664

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-664: Improper Control of a Resource Through its Lifetime and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/664.html and https://cve.bz/cve/cwe/664?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2026-57187EPSS 0.5%

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJS…

  2. 9.8CVE-2026-76408EPSS 0.4%

    As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discover…

  3. 8.8CVE-2026-76300EPSS 0.4%

    As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discover…

  4. 8.5CVE-2026-94192EPSS 0.1%

    A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, includi…

  5. 5.3CVE-2026-68908EPSS 0.5%

    libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report…

  6. 5.3CVE-2026-57446EPSS 0.4%

    libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle b…

  7. 8.7CVE-2026-102026EPSS 0.5%

    An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a routing-daemon crash via a BGP route update…

  8. 8.8CVE-2026-76282EPSS 0.4%

    As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discover…

  9. 9.8CVE-2026-76500EPSS 0.3%

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in…

  10. 7.5CVE-2026-76467EPSS 0.3%

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addres…

  11. 8.8CVE-2026-20336EPSS 0.3%

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engi…

  12. 8.7CVE-2026-54251EPSS 0.5%

    netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestRe…

  13. 9.8CVE-2026-20353EPSS 0.5%

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review res…

  14. 6.3CVE-2026-86203EPSS 0.3%

    PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing …

  15. 4.3CVE-2026-79603EPSS 0.2%

    x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, t…

  16. 9.8CVE-2026-20274EPSS 0.5%

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that …

  17. 3.1CVE-2026-79289EPSS 0.3%

    Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security …

  18. 7.5CVE-2026-18549EPSS 0.6%

    @fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the un…

  19. 9.8CVE-2026-72041EPSS 0.7%

    In the Linux kernel, the following vulnerability has been resolved: espintcp: use sk_msg_free_partial to fix partial send sk_msg_free_partial() ensures consistency of the skmsg at every iteration, without having to manually handle unchar…

  20. 1.8CVE-2026-19380EPSS 0.2%

    A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of reference count. Local access is required to ap…

  21. 8.6CVE-2026-20269EPSS 0.5%

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that ad…

  22. 5.5CVE-2026-64721EPSS 0.2%

    This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.…

  23. 7.5CVE-2026-20158EPSS 0.5%

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses …

  24. 8.8CVE-2026-43503ExploitEPSS 2.0%

    In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHAR…

  25. 5.3CVE-2026-8582EPSS 0.2%

    Object lifecycle issue in Dawn in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

  26. 8.8CVE-2026-8517EPSS 0.5%

    Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security sever…

  27. 8.8CVE-2026-43158EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes o…

  28. 7.1CVE-2025-34226EPSS 0.7%

    OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epoch_time field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a su…

  29. 3.3CVE-2025-54621EPSS 0.1%

    Iterator failure issue in the WantAgent module. Impact: Successful exploitation of this vulnerability may cause memory release failures.

  30. 3.3CVE-2025-54619EPSS 0.1%

    Iterator failure issue in the multi-mode input module. Impact: Successful exploitation of this vulnerability may cause iterator failures and affect availability.

  31. 3.3CVE-2025-54613EPSS 0.1%

    Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may affect function stability.

  32. 3.3CVE-2025-54612EPSS 0.1%

    Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may affect function stability.

  33. 7.5CVE-2024-41169EPSS 0.7%

    The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0. Users are recommended to…

  34. 7.1CVE-2025-21593EPSS 0.2%

    An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial-of-Service (DoS)…

  35. 5.0CVE-2024-45383EPSS 1.5%

    A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.3636 (WinBuild.160101.0800). A specially crafted application can issue multiple IRP Complete requests…

  36. 7.0CVE-2024-7889EPSS 0.2%

    Local privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows

  37. 6.5CVE-2024-37139EPSS 0.5%

    Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an Improper Control of a Resource Through its Lifetime vulnerability in an admin operation. A remote low privileged attacker could potentially e…

  38. 5.5CVE-2020-36774EPSS 0.2%

    plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash).

  39. 7.5CVE-2023-52387EPSS 0.3%

    Resource reuse vulnerability in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality.

  40. 7.8CVE-2024-23639EPSS 0.3%

    Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Kotlin and the Groovy language. Enabled but unsecured management endpoints are sus…

  41. 5.5CVE-2024-22365EPSS 0.5%

    linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

  42. 8.1CVE-2023-44295EPSS 0.4%

    Dell PowerScale OneFS versions 8.2.2.x through 9.6.0.x contains an improper control of a resource through its lifetime vulnerability. A low privilege attacker could potentially exploit this vulnerability, leading to loss of information, an…

  43. 7.5CVE-2023-44288EPSS 0.7%

    Dell PowerScale OneFS, 8.2.2.x through 9.6.0.x, contains an improper control of a resource through its lifetime vulnerability. An unauthenticated network attacker could potentially exploit this vulnerability, leading to denial of service.

  44. 6.5CVE-2023-25942EPSS 0.6%

    Dell PowerScale OneFS versions 8.2.x-9.4.x contain an uncontrolled resource consumption vulnerability. A malicious network user with low privileges could potentially exploit this vulnerability in SMB, leading to a potential denial of servi…

  45. 7.5CVE-2022-32846EPSS 0.6%

    A logic issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to access user-sensitive data.

  46. 6.5CVE-2022-28287EPSS 0.6%

    In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. This vulnerability affects Firefox < 99.

  47. 9.8CVE-2022-27518KEVEPSS 6.9%

    Unauthenticated remote arbitrary code execution

  48. 7.1CVE-2022-46144EPSS 0.9%

    A vulnerability has been identified in SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V2.3), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions >= V2.3 < V3.0), SCALANCE SC626-2C (6GK5626-2GS00-2AC2) (All versions < V2.3), SCALAN…

  49. 6.5CVE-2022-22250EPSS 0.3%

    An Improper Control of a Resource Through its Lifetime vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS and Junos OS Evolved allows unauthenticated adjacent attacker to cause a Denial of Service (DoS). In an EVP…

  50. 6.5CVE-2022-22249EPSS 0.5%

    An Improper Control of a Resource Through its Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS). When there…