Weaknesses of type CWE-459

158 results

Limpeza incompleta de recursos

Ocorre quando o software falha em liberar ou limpar completamente recursos (memória, arquivos abertos, conexões de rede, dados sensíveis em memória) antes de encerrar um processo ou função. Isso permite vazamento de dados sensíveis, consumo não controlado de recursos ou comportamentos inesperados em estados posteriores do programa.

Example

Uma aplicação autentica um usuário, armazena a senha em uma variável de buffer, mas encerra a sessão sem sobrescrever o buffer com zeros. Um atacante com acesso à memória pode recuperar a senha ainda presente. Ou um arquivo temporário com dados confidenciais não é deletado após o uso, ficando acessível no disco.

How to mitigate

Implemente handlers de limpeza explícitos (finally, destructores, context managers em Python) que garantam liberação de recursos mesmo em casos de erro. Para dados sensíveis, sobrescreva com zeros antes de liberar memória. Use ferramentas de análise estática e testes de vazamento de memória (valgrind, AddressSanitizer) para detectar limpezas incompletas.

CVE-2026-75943LOWA brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcemEPSS 0.2%CVE-2026-75945LOWA race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.EPSS 0.2%CVE-2022-40974LOWIncomplete cleanup in the Intel(R) IPP Cryptography software before version 2021.6 may allow a privileged user to potentially enable informaEPSS 0.2%CVE-2024-53869MEDIUMNVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. A successful exploit of tEPSS 0.2%CVE-2026-15390CRITICALOut-of-bounds write in Das U-BootEPSS 0.2%CVE-2026-106262MEDIUMIncomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer procesEPSS 0.2%CVE-2026-108982HIGHVeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary sEPSS 0.2%CVE-2022-25664MEDIUMInformation disclosure due to exposure of information while GPU reads the data in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectiviEPSS 0.2%CVE-2022-46298LOWIncomplete cleanup for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access.EPSS 0.2%CVE-2026-53867MEDIUMCapgo < 12.128.2 - Orphaned File Retention via Profile Image ReplacementEPSS 0.2%CVE-2026-121055—Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a EPSS 0.2%CVE-2026-7639HIGHGPU DDK - Page UAF read in PMMETA_PROTECT heap memoryEPSS 0.2%CVE-2026-72714MEDIUMRocq Prover through 9.2.0 Universe Checking State Desynchronised After Module CloseEPSS 0.2%CVE-2025-43711HIGHTunnelblick 3.5beta06 before 7.0, when incompletely uninstalled, allows attackers to execute arbitrary code as root (upon the next boot) by EPSS 0.2%CVE-2026-63875HIGHarm64: tlb: Flush walk cache when unsharing PMD tablesEPSS 0.2%CVE-2024-36353MEDIUMInsufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values potentialEPSS 0.2%CVE-2026-20712MEDIUMIncomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may allow an information disclosure. System softwEPSS 0.2%CVE-2025-0032HIGHImproper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microcoEPSS 0.2%CVE-2024-21977LOWIncomplete cleanup after loading a CPU microcode patch may allow a privileged attacker to degrade the entropy of the RDRAND instruction, potEPSS 0.2%CVE-2024-53881MEDIUMNVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt storm on the host, which EPSS 0.2%