# CWE-664.

Every Advisory and CVE whose sources give the weakness CWE-664, newest first.

## Records, newest first

- [Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing](https://agentprime.io/advisories/CVE-2026-57187.md)
  `CVE-2026-57187` · CVE record: asterisk asterisk and 1 more · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption, CWE-664
- [Improper Control of a Resource Through its Lifetime in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76408.md)
  `CVE-2026-76408` · CVE record: Splunk Splunk SOAR · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-664
- [Security Hardening in Splunk Enterprise - October 2026](https://agentprime.io/advisories/CVE-2026-76300.md)
  `CVE-2026-76300` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-664
- [Module object deallocation can free a live ThreadX kernel object](https://agentprime.io/advisories/CVE-2026-94192.md)
  `CVE-2026-94192` · CVE record: Eclipse Foundation Eclipse ThreadX · CVSS 8.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption, CWE-664
- [libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send path](https://agentprime.io/advisories/CVE-2026-68908.md)
  `CVE-2026-68908` · CVE record: mz-automation libiec61850 · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption, CWE-590, CWE-664
- [libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE\* handle](https://agentprime.io/advisories/CVE-2026-57446.md)
  `CVE-2026-57446` · CVE record: mz-automation libiec61850 · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption, CWE-664, CWE-672
- [Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB sharding is used](https://agentprime.io/advisories/CVE-2026-102026.md)
  `CVE-2026-102026` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-664
- [Improper Control of a Resource Through its Lifetime in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76282.md)
  `CVE-2026-76282` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-664
- [Cisco Meraki Software Hardening Release - Resource Lifetime Management Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76467.md)
  `CVE-2026-76467` · CVE record: Cisco Cisco Campus Gateway Software and 3 more · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-664
- [Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76500.md)
  `CVE-2026-76500` · CVE record: Cisco Cisco Application Policy Infrastructure Controller (APIC) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-664
- [Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Resource Lifetime Management Vulnerabilit…](https://agentprime.io/advisories/CVE-2026-20336.md)
  `CVE-2026-20336` · CVE record: Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and 2 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-664
- [Cisco Secure Email Gateway Security Hardening Release](https://agentprime.io/advisories/CVE-2026-20353.md)
  `CVE-2026-20353` · CVE record: Cisco Cisco Secure Email · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-664
- [Unconditionally do TLB flushing ahead of page scrubbing](https://agentprime.io/advisories/CVE-2026-79603.md)
  `CVE-2026-79603` · CVE record: Xen Xen · CVSS 4.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-664
- [Cisco IOS XR Software Security Hardening Release: September 2026](https://agentprime.io/advisories/CVE-2026-20274.md)
  `CVE-2026-20274` · CVE record: Cisco Cisco IOS XR Software · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-664
- [Google Chrome: Improper control of a resource through its lifetime in Workers in Google Chrome prior to…](https://agentprime.io/advisories/CVE-2026-79289.md)
  `CVE-2026-79289` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-664
- [netty-incubator-codec-ohttp: \[OHttpServerCodec\] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service](https://agentprime.io/advisories/GHSA-vmr9-j6wf-pmh2.md)
  `GHSA-vmr9-j6wf-pmh2`, `CVE-2026-54251` · Maven `io.netty.incubator:netty-incubator-codec-ohttp`: affected `<0.0.23.Final`, fixed in `0.0.23.Final` · CVSS 8.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-664
- [@fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit](https://agentprime.io/advisories/CVE-2026-18549.md)
  `CVE-2026-18549` · CVE record: @fastify/multipart @fastify/multipart · CVSS 7.5 High · Not analysed yet · Published 15 Aug 2026 · Tags: Denial of service, CWE-664
- [espintcp: use sk_msg_free_partial to fix partial send](https://agentprime.io/advisories/CVE-2026-72041.md)
  `CVE-2026-72041` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Aug 2026 · Tags: CWE-664
- [Mullvad wireguard.sys IOCTL AdapterState reference count](https://agentprime.io/advisories/CVE-2026-19380.md)
  `CVE-2026-19380` · CVE record: Mullvad wireguard.sys · CVSS 4.6 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-664, CWE-911
- [Cisco IOS XE Software Security Hardening Release](https://agentprime.io/advisories/CVE-2026-20269.md)
  `CVE-2026-20269` · CVE record: Cisco Cisco IOS XE Software · CVSS 8.6 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-664
- [This issue was addressed through improved state management.](https://agentprime.io/advisories/CVE-2026-64721.md)
  `CVE-2026-64721` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: CWE-664
- [Cisco RoomOS Security Hardening Release - Resource Lifetime Management Vulnerabilities](https://agentprime.io/advisories/CVE-2026-20158.md)
  `CVE-2026-20158` · CVE record: Cisco Cisco RoomOS Software · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2026 · Tags: CWE-664
- [net: skbuff: propagate shared-frag marker through frag-transfer helpers](https://agentprime.io/advisories/CVE-2026-43503.md)
  `CVE-2026-43503` · CVE record: Linux Linux · CVSS 8.8 High · Not analysed yet · Published 23 May 2026 · Tags: CWE-664, CWE-691
- [Google Chrome: Object lifecycle issue in Dawn in Google Chrome prior to 148.0.7778.168 allowed a remote…](https://agentprime.io/advisories/CVE-2026-8582.md)
  `CVE-2026-8582` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 14 May 2026 · Tags: CWE-664
- [Google Chrome: Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168…](https://agentprime.io/advisories/CVE-2026-8517.md)
  `CVE-2026-8517` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 14 May 2026 · Tags: CWE-664
- [xfs: fix freemap adjustments when adding xattrs to leaf blocks](https://agentprime.io/advisories/CVE-2026-43158.md)
  `CVE-2026-43158` · CVE record: Linux Linux · CVSS 8.8 High · Not analysed yet · Published 6 May 2026 · Tags: CWE-664
- [PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state](https://agentprime.io/advisories/GHSA-f9jp-856v-8642.md)
  `GHSA-f9jp-856v-8642`, `CVE-2026-86203`, `PKSA-t7y4-spmt-39ct` · Packagist `pocketmine/pocketmine-mp`: affected `<5.39.2`, fixed in `5.39.2` · CVSS 6.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-664
- [OpenPLC Runtime v3 Persistent DoS](https://agentprime.io/advisories/CVE-2025-34226.md)
  `CVE-2025-34226` · CVE record: Autonomy Logic OpenPLC Runtime · CVSS 7.1 High · Not analysed yet · Published 3 Oct 2025 · Tags: CWE-20, CWE-664
- [Iterator failure issue in the WantAgent module.](https://agentprime.io/advisories/CVE-2025-54621.md)
  `CVE-2025-54621` · CVE record: Huawei HarmonyOS · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2025 · Tags: CWE-664
- [Iterator failure issue in the multi-mode input module.](https://agentprime.io/advisories/CVE-2025-54619.md)
  `CVE-2025-54619` · CVE record: Huawei HarmonyOS · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2025 · Tags: CWE-664
- [Iterator failure vulnerability in the card management module.](https://agentprime.io/advisories/CVE-2025-54613.md)
  `CVE-2025-54613` · CVE record: Huawei HarmonyOS · CVSS 5.9 Medium · Not analysed yet · Published 6 Aug 2025 · Tags: CWE-664
- [Iterator failure vulnerability in the card management module.](https://agentprime.io/advisories/CVE-2025-54612.md)
  `CVE-2025-54612` · CVE record: Huawei HarmonyOS · CVSS 5.9 Medium · Not analysed yet · Published 6 Aug 2025 · Tags: CWE-664
- [Apache Zeppelin exposes server resources to unauthenticated attackers](https://agentprime.io/advisories/GHSA-7pgf-ppxw-8624.md)
  `GHSA-7pgf-ppxw-8624`, `CVE-2024-41169` · Maven `org.apache.zeppelin:zeppelin-interpreter` and 1 more: affected `>=0.10.1, <0.12.0`, fixed in `0.12.0` · CVSS 7.5 High · Not analysed yet · Published 12 Jul 2025 · Tags: CWE-664
- [Tokio broadcast channel calls clone in parallel, but does not require \`Sync\`](https://agentprime.io/advisories/GHSA-rr8g-9fpq-6wmg.md)
  `GHSA-rr8g-9fpq-6wmg`, `RUSTSEC-2025-0023` · crates.io `tokio`: affected `>=0.2.5, <1.38.2 || >=1.39.0, <1.43.1 || >=1.44.0, <1.44.2`, fixed in `1.38.2`, `1.43.1`, `1.44.2` · CVSS 4.0, no score published · Not analysed yet · Published 7 Apr 2025 · Tags: CWE-664
- [Junos OS and Junos OS Evolved: On SRv6 enabled devices, an attacker sending a malformed BGP update can cause the rpd to crash](https://agentprime.io/advisories/CVE-2025-21593.md)
  `CVE-2025-21593` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.1 High · Not analysed yet · Published 9 Jan 2025 · Tags: CWE-664
- [A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.3636 (WinBuild.160101.0800).](https://agentprime.io/advisories/CVE-2024-45383.md)
  `CVE-2024-45383` · CVE record: Microsoft HDAudBus.sys · CVSS 5.0 Medium · Not analysed yet · Published 12 Sept 2024 · Tags: CWE-664
- [Local privilege escalation allows a low-privileged user to gain SYSTEM privileges](https://agentprime.io/advisories/CVE-2024-7889.md)
  `CVE-2024-7889` · CVE record: Citrix Citrix Workspace app for Windows · CVSS 7.0 High · Not analysed yet · Published 11 Sept 2024 · Tags: CWE-664
- [Improper Control of a Resource Through its Lifetime in Mattermost in github.com/mattermost/mattermost-server](https://agentprime.io/advisories/GHSA-fxwj-v664-wv5g.md)
  `GHSA-fxwj-v664-wv5g`, `BIT-mattermost-2022-1385`, `CVE-2022-1385`, `GO-2022-0599` · Go `github.com/mattermost/mattermost-server` and 2 more: affected `*`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 21 Aug 2024 · Tags: CWE-664
- [Dell PowerProtect DD: Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30…](https://agentprime.io/advisories/CVE-2024-37139.md)
  `CVE-2024-37139` · CVE record: Dell PowerProtect DD · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2024 · Tags: CWE-664
- [plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash).](https://agentprime.io/advisories/CVE-2020-36774.md)
  `CVE-2020-36774` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 19 Feb 2024 · Tags: CWE-664
- [Resource reuse vulnerability in the GPU module.](https://agentprime.io/advisories/CVE-2023-52387.md)
  `CVE-2023-52387` · CVE record: Huawei HarmonyOS and 1 more · CVSS 7.5 High · Not analysed yet · Published 18 Feb 2024 · Tags: CWE-664
- [Micronaut management endpoints vulnerable to drive-by localhost attack](https://agentprime.io/advisories/GHSA-583g-g682-crxf.md)
  `GHSA-583g-g682-crxf`, `CVE-2024-23639` · Maven `io.micronaut:micronaut-http-server` and 2 more: affected `<3.8.3`, fixed in `3.8.3` · CVSS 5.1 Medium · Not analysed yet · Published 9 Feb 2024 · Tags: CWE-15, CWE-610, CWE-664
- [linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.](https://agentprime.io/advisories/CVE-2024-22365.md)
  `CVE-2024-22365` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 6 Feb 2024 · Tags: CWE-664
- [Dell PowerScale OneFS: Dell PowerScale OneFS versions 8.2.2.x through 9.6.0.x contains an improper control of a…](https://agentprime.io/advisories/CVE-2023-44295.md)
  `CVE-2023-44295` · CVE record: Dell PowerScale OneFS · CVSS 6.3 Medium · Not analysed yet · Published 5 Dec 2023 · Tags: CWE-664
- [Dell PowerScale OneFS: Dell PowerScale OneFS, 8.2.2.x through 9.6.0.x…](https://agentprime.io/advisories/CVE-2023-44288.md)
  `CVE-2023-44288` · CVE record: Dell PowerScale OneFS · CVSS 7.5 High · Not analysed yet · Published 5 Dec 2023 · Tags: CWE-664
- [Dell PowerScale OneFS: Dell PowerScale OneFS versions 8.2.x-9.4.x contain an uncontrolled resource consumption…](https://agentprime.io/advisories/CVE-2023-25942.md)
  `CVE-2023-25942` · CVE record: Dell PowerScale OneFS · CVSS 6.5 Medium · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-664
- [A logic issue was addressed with improved state management.](https://agentprime.io/advisories/CVE-2022-32846.md)
  `CVE-2022-32846` · CVE record: Apple Apple Music for Android · CVSS 7.5 High · Not analysed yet · Published 27 Feb 2023 · Tags: CWE-664
- [Mozilla Firefox: In unusual circumstances, selecting text could cause text selection caching to behave…](https://agentprime.io/advisories/CVE-2022-28287.md)
  `CVE-2022-28287` · CVE record: Mozilla Firefox · CVSS 6.5 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-664
- [Siemens SCALANCE SC622-2C: A vulnerability has been identified in SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All…](https://agentprime.io/advisories/CVE-2022-46144.md)
  `CVE-2022-46144` · CVE record: Siemens SCALANCE SC622-2C and 4 more · CVSS 7.1 High · Not analysed yet · Published 13 Dec 2022 · Tags: CWE-664
- [Unauthenticated remote arbitrary code execution](https://agentprime.io/advisories/CVE-2022-27518.md)
  `CVE-2022-27518` · CVE record: Citrix Citrix Gateway, Citrix ADC · CVSS 9.8 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 13 Dec 2022 · Tags: CWE-664
- [Junos OS and Junos OS Evolved: An FPC crash might be seen due to an EVPN MAC entry moving from local to remote](https://agentprime.io/advisories/CVE-2022-22250.md)
  `CVE-2022-22250` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Oct 2022 · Tags: CWE-664
- [Junos OS: MX Series: An FPC crash might be seen due to mac-moves within the same bridge domain](https://agentprime.io/advisories/CVE-2022-22249.md)
  `CVE-2022-22249` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 18 Oct 2022 · Tags: CWE-664
- [Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Mobility Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2022-20856.md)
  `CVE-2022-20856` · CVE record: Cisco Cisco IOS XE Software · CVSS 8.6 High · Not analysed yet · Published 30 Sept 2022 · Tags: CWE-664
- [OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli](https://agentprime.io/advisories/GHSA-8mjr-jr5h-q2xr.md)
  `GHSA-8mjr-jr5h-q2xr`, `CVE-2022-31153`, `PYSEC-2026-890` · PyPI `openzeppelin-cairo-contracts`: affected `<0.2.1`, fixed in `0.2.1` · CVSS 6.5 Medium · Not analysed yet · Published 15 Jul 2022 · Tags: Broken access control, CWE-664
- [Jetty vulnerable to Invalid HTTP/2 requests that can lead to denial of service](https://agentprime.io/advisories/GHSA-wgmr-mf83-7x4j.md)
  `GHSA-wgmr-mf83-7x4j`, `BIT-jenkins-2022-2048`, `CVE-2022-2048` · Maven `org.eclipse.jetty.http2:http2-server`: affected `<9.4.47 || >=10.0.0, <10.0.10 || >=11.0.0, <11.0.10`, fixed in `9.4.47`, `10.0.10`, `11.0.10` · CVSS 7.5 High · Not analysed yet · Published 7 Jul 2022 · Tags: Denial of service, CWE-410, CWE-664
- [Jetty SslConnection does not release pooled ByteBuffers in case of errors](https://agentprime.io/advisories/GHSA-8mpp-f3f7-xc28.md)
  `GHSA-8mpp-f3f7-xc28`, `CVE-2022-2191` · Maven `org.eclipse.jetty:jetty-server`: affected `>=10.0.0, <10.0.10 || >=11.0.0, <11.0.10`, fixed in `10.0.10`, `11.0.10` · CVSS 7.5 High · Not analysed yet · Published 7 Jul 2022 · Tags: Denial of service, CWE-664
- [Temporary disruption of the ADM license service](https://agentprime.io/advisories/CVE-2022-27512.md)
  `CVE-2022-27512` · CVE record: Citrix Citrix Application Delivery Management (Citrix ADM) · No CVSS score · Not analysed yet · Published 16 Jun 2022 · Tags: CWE-664
- [Cisco Firepower Threat Defense Software Local Malware Analysis Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2022-20748.md)
  `CVE-2022-20748` · CVE record: Cisco Cisco Firepower Threat Defense Software · CVSS 5.3 Medium · Not analysed yet · Published 3 May 2022 · Tags: CWE-664
- [Cisco UCS Manager Software SSH Sessions Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2021-1592.md)
  `CVE-2021-1592` · CVE record: Cisco Cisco Unified Computing System (Managed) · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2021 · Tags: CWE-664
- [Cisco UCS Manager Software Local Management CLI Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2020-3504.md)
  `CVE-2020-3504` · CVE record: Cisco Cisco Unified Computing System (Managed) · CVSS 3.3 Low · Not analysed yet · Published 27 Aug 2020 · Tags: CWE-664

Older: <https://agentprime.io/advisories/tag/cwe-664.md?cursor=WyIyMDIwLTA4LTI3VDE1OjQwOjEzLjI5MjAwMFoiLCJDVkUtMjAyMC0zNTA0Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-664>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-664/>. Everything for agents: <https://agentprime.io/llms.txt>.