Weaknesses of type CWE-459

158 results

Limpeza incompleta de recursos

Ocorre quando o software falha em liberar ou limpar completamente recursos (memória, arquivos abertos, conexões de rede, dados sensíveis em memória) antes de encerrar um processo ou função. Isso permite vazamento de dados sensíveis, consumo não controlado de recursos ou comportamentos inesperados em estados posteriores do programa.

Example

Uma aplicação autentica um usuário, armazena a senha em uma variável de buffer, mas encerra a sessão sem sobrescrever o buffer com zeros. Um atacante com acesso à memória pode recuperar a senha ainda presente. Ou um arquivo temporário com dados confidenciais não é deletado após o uso, ficando acessível no disco.

How to mitigate

Implemente handlers de limpeza explícitos (finally, destructores, context managers em Python) que garantam liberação de recursos mesmo em casos de erro. Para dados sensíveis, sobrescreva com zeros antes de liberar memória. Use ferramentas de análise estática e testes de vazamento de memória (valgrind, AddressSanitizer) para detectar limpezas incompletas.

CVE-2026-95303MEDIUMIncomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass syEPSS 0.3%CVE-2026-9693LOWMattermost thread memberships persist after team removal, exposing private channel thread metadata on re-inviteEPSS 0.3%CVE-2022-27639MEDIUMIncomplete cleanup in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentialEPSS 0.3%CVE-2024-1048LOWGrub2: grub2-set-bootflag can be abused by local (pseudo-)usersEPSS 0.3%CVE-2026-116132HIGHHTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on diskEPSS 0.2%CVE-2026-91730LOWIncomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer procesEPSS 0.2%CVE-2022-3238HIGHA double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount and umount simultaneously. This flaw allowEPSS 0.2%CVE-2025-55910MEDIUMCMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.EPSS 0.2%CVE-2026-106394MEDIUMIncomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-oriEPSS 0.2%CVE-2023-29184LOWAn incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before & FortiProxy version 7.2.0 through 7.2.2 and before 7.EPSS 0.2%CVE-2023-45846MEDIUMIncomplete cleanup in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable denial of EPSS 0.2%CVE-2026-106366MEDIUMIncomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policyEPSS 0.2%CVE-2022-43477LOWIncomplete cleanup for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local accEPSS 0.2%CVE-2026-75944MEDIUMA race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. UserEPSS 0.2%CVE-2026-63545LOWSharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. They may be accessed latEPSS 0.2%CVE-2026-85033MEDIUMBluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peerEPSS 0.2%CVE-2023-31356MEDIUMIncomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting inEPSS 0.2%CVE-2026-82237LOWfilebrowser through 2.63.23 Stale Share Link via File RenameEPSS 0.2%CVE-2025-20293MEDIUMA vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL) coulEPSS 0.2%CVE-2022-26074MEDIUMIncomplete cleanup in a firmware subsystem for Intel(R) SPS before versions SPS_E3_04.08.04.330.0 and SPS_E3_04.01.04.530.0 may allow a privEPSS 0.2%