Advisories · Weakness
CWE-664.
Every Advisory and CVE whose sources give the weakness CWE-664, newest first.
- CVSS 7.1 High
Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
- asterisk
- certified-asterisk
- Memory corruption
- CWE-664
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper Control of a Resource Through its Lifetime in Splunk SOAR
- Splunk SOAR
- CWE-664
- CVSS 8.8 High
Security Hardening in Splunk Enterprise - October 2026
- Splunk Enterprise
- CWE-664
- CVSS 8.5 High
Module object deallocation can free a live ThreadX kernel object
- Eclipse Foundation Eclipse ThreadX
- Memory corruption
- CWE-664
- CVSS 5.3 Medium
libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send path
- mz-automation libiec61850
- Memory corruption
- CWE-590
- CVSS 5.3 Medium
libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handle
- mz-automation libiec61850
- Memory corruption
- CWE-664
- CVSS 8.7 High
Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB sharding is used
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- CWE-664
- CVSS 8.8 High
Improper Control of a Resource Through its Lifetime in Splunk Enterprise
- Splunk Enterprise
- CWE-664
- CVSS 7.5 High
Cisco Meraki Software Hardening Release - Resource Lifetime Management Vulnerabilities
- Cisco Campus Gateway Software
- Cisco Meraki MR Wireless Access Points Software
- CWE-664
- CVSS 9.8 CriticalCritical · CVSS 9+
Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime Vulnerabilities
- Cisco Application Policy Infrastructure Controller (APIC)
- CWE-664
- CVSS 8.8 High
Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Resource Lifetime Management Vulnerabilit…
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
- Cisco Secure Firewall Management Center (FMC)
- CWE-664
- CVSS 9.8 CriticalCritical · CVSS 9+
Cisco Secure Email Gateway Security Hardening Release
- Cisco Secure Email
- CWE-664
- CVSS 4.3 Medium
Unconditionally do TLB flushing ahead of page scrubbing
- Xen
- CWE-664
- CVSS 9.8 CriticalCritical · CVSS 9+
Cisco IOS XR Software Security Hardening Release: September 2026
- Cisco IOS XR Software
- CWE-664
- CVSS 3.1 Low
Google Chrome: Improper control of a resource through its lifetime in Workers in Google Chrome prior to…
- Google Chrome
- CWE-664
- CVSS 8.7 High
netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service
- CWE-664
<0.0.23.Final · fixed in 0.0.23.Final
GHSA-vmr9-j6wf-pmh2 · CVE-2026-54251 - CVSS 7.5 High
@fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit
- @fastify/multipart
- Denial of service
- CWE-664
- CVSS 9.8 CriticalCritical · CVSS 9+
espintcp: use sk_msg_free_partial to fix partial send
- Linux kernel
- CWE-664
- CVSS 4.6 Medium
Mullvad wireguard.sys IOCTL AdapterState reference count
- Mullvad wireguard.sys
- CWE-664
- CWE-911
- CVSS 8.6 High
Cisco IOS XE Software Security Hardening Release
- Cisco IOS XE Software
- CWE-664
- CVSS 5.5 Medium
This issue was addressed through improved state management.
- Apple iOS and iPadOS
- Apple macOS
- CWE-664
- CVSS 7.5 High
Cisco RoomOS Security Hardening Release - Resource Lifetime Management Vulnerabilities
- Cisco RoomOS Software
- CWE-664
- CVSS 8.8 High
net: skbuff: propagate shared-frag marker through frag-transfer helpers
- Linux kernel
- CWE-664
- CWE-691
- CVSS 5.3 Medium
Google Chrome: Object lifecycle issue in Dawn in Google Chrome prior to 148.0.7778.168 allowed a remote…
- Google Chrome
- CWE-664
- CVSS 8.8 High
Google Chrome: Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168…
- Google Chrome
- CWE-664
- CVSS 8.8 High
xfs: fix freemap adjustments when adding xattrs to leaf blocks
- Linux kernel
- CWE-664
- CVSS 6.3 Medium
PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state
- CWE-664
<5.39.2 · fixed in 5.39.2
GHSA-f9jp-856v-8642 · CVE-2026-86203 - CVSS 7.1 High
OpenPLC Runtime v3 Persistent DoS
- Autonomy Logic OpenPLC Runtime
- CWE-20
- CWE-664
- CVSS 5.3 Medium
Iterator failure issue in the WantAgent module.
- Huawei HarmonyOS
- CWE-664
- CVSS 5.3 Medium
Iterator failure issue in the multi-mode input module.
- Huawei HarmonyOS
- CWE-664
- CVSS 5.9 Medium
Iterator failure vulnerability in the card management module.
- Huawei HarmonyOS
- CWE-664
- CVSS 5.9 Medium
Iterator failure vulnerability in the card management module.
- Huawei HarmonyOS
- CWE-664
- CVSS 7.5 High
Apache Zeppelin exposes server resources to unauthenticated attackers
- CWE-664
>=0.10.1, <0.12.0 · fixed in 0.12.0
GHSA-7pgf-ppxw-8624 · CVE-2024-41169 - CVSS 4.0, no score published
Tokio broadcast channel calls clone in parallel, but does not require `Sync`
- CWE-664
>=0.2.5, <1.38.2 || >=1.39.0, <1.43.1 || >=1.44.0, <1.44.2 · fixed in 1.38.2, 1.43.1, 1.44.2
GHSA-rr8g-9fpq-6wmg - CVSS 7.1 High
Junos OS and Junos OS Evolved: On SRv6 enabled devices, an attacker sending a malformed BGP update can cause the rpd to crash
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- CWE-664
- CVSS 5.0 Medium
A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.3636 (WinBuild.160101.0800).
- Microsoft HDAudBus.sys
- CWE-664
- CVSS 7.0 High
Local privilege escalation allows a low-privileged user to gain SYSTEM privileges
- Citrix Workspace app for Windows
- CWE-664
- CVSS 3.7 Low
Improper Control of a Resource Through its Lifetime in Mattermost in github.com/mattermost/mattermost-server
- CWE-664
* · no fixed version yet
GHSA-fxwj-v664-wv5g · CVE-2022-1385 - CVSS 6.5 Medium
Dell PowerProtect DD: Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30…
- Dell PowerProtect DD
- CWE-664
- CVSS 5.5 Medium
plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash).
- CWE-664
- CVSS 7.5 High
Resource reuse vulnerability in the GPU module.
- Huawei HarmonyOS
- Huawei EMUI
- CWE-664
- CVSS 5.1 Medium
Micronaut management endpoints vulnerable to drive-by localhost attack
- CWE-15
- CWE-610
<3.8.3 · fixed in 3.8.3
GHSA-583g-g682-crxf · CVE-2024-23639 - CVSS 5.5 Medium
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
- CWE-664
- CVSS 6.3 Medium
Dell PowerScale OneFS: Dell PowerScale OneFS versions 8.2.2.x through 9.6.0.x contains an improper control of a…
- Dell PowerScale OneFS
- CWE-664
- CVSS 7.5 High
Dell PowerScale OneFS: Dell PowerScale OneFS, 8.2.2.x through 9.6.0.x…
- Dell PowerScale OneFS
- CWE-664
- CVSS 6.5 Medium
Dell PowerScale OneFS: Dell PowerScale OneFS versions 8.2.x-9.4.x contain an uncontrolled resource consumption…
- Dell PowerScale OneFS
- CWE-664
- CVSS 7.5 High
A logic issue was addressed with improved state management.
- Apple Music for Android
- CWE-664
- CVSS 6.5 Medium
Mozilla Firefox: In unusual circumstances, selecting text could cause text selection caching to behave…
- Mozilla Firefox
- CWE-664
- CVSS 7.1 High
Siemens SCALANCE SC622-2C: A vulnerability has been identified in SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All…
- Siemens SCALANCE SC622-2C
- Siemens SCALANCE SC626-2C
- CWE-664
- CVSS 9.8 CriticalCritical · KEV, CVSS 9+KEV
Unauthenticated remote arbitrary code execution
- Citrix Gateway, Citrix ADC
- CWE-664
- CVSS 6.5 Medium
Junos OS and Junos OS Evolved: An FPC crash might be seen due to an EVPN MAC entry moving from local to remote
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- CWE-664
- CVSS 6.5 Medium
Junos OS: MX Series: An FPC crash might be seen due to mac-moves within the same bridge domain
- Juniper Networks Junos OS
- CWE-664
- CVSS 8.6 High
Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Mobility Denial of Service Vulnerability
- Cisco IOS XE Software
- CWE-664
- CVSS 6.5 Medium
OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli
- Broken access control
- CWE-664
<0.2.1 · fixed in 0.2.1
GHSA-8mjr-jr5h-q2xr · CVE-2022-31153 - CVSS 7.5 High
Jetty vulnerable to Invalid HTTP/2 requests that can lead to denial of service
- Denial of service
- CWE-410
<9.4.47 || >=10.0.0, <10.0.10 || >=11.0.0, <11.0.10 · fixed in 9.4.47, 10.0.10, 11.0.10
GHSA-wgmr-mf83-7x4j · CVE-2022-2048 - CVSS 7.5 High
Jetty SslConnection does not release pooled ByteBuffers in case of errors
- Denial of service
- CWE-664
>=10.0.0, <10.0.10 || >=11.0.0, <11.0.10 · fixed in 10.0.10, 11.0.10
GHSA-8mpp-f3f7-xc28 · CVE-2022-2191 -
Temporary disruption of the ADM license service
- Citrix Application Delivery Management (Citrix ADM)
- CWE-664
- CVSS 5.3 Medium
Cisco Firepower Threat Defense Software Local Malware Analysis Denial of Service Vulnerability
- Cisco Firepower Threat Defense Software
- CWE-664
- CVSS 4.3 Medium
Cisco UCS Manager Software SSH Sessions Denial of Service Vulnerability
- Cisco Unified Computing System (Managed)
- CWE-664
- CVSS 3.3 Low
Cisco UCS Manager Software Local Management CLI Denial of Service Vulnerability
- Cisco Unified Computing System (Managed)
- CWE-664