CWE · MITRE source
CWE-590Free of Memory not on the Heap
The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().
When free() is called on an invalid pointer, the program's memory management data structures may become corrupted. This corruption can cause the program to crash or, in some circumstances, an attacker may be able to cause free() to operate on controllable memory locations to modify critical program variables or execute code.
Last updated: 14 October 2026 20:41 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2020-6016 UPD | 8.0 | 9.8 | 0.0600 | 2020-11-18 |
CVE-2021-42377 UPD | 7.8 | 9.8 | 0.0362 | 2021-11-15 |
CVE-2026-76465 | 7.3 | 9.8 | 0.0045 | 2026-10-07 |
CVE-2022-31625 UPD | 6.7 | 8.1 | 0.0379 | 2022-06-16 |
CVE-2023-42459 UPD | 6.7 | 8.6 | 0.0083 | 2023-10-16 |
CVE-2026-95311 | 6.7 | 9.6 | 0.0046 | 2026-09-29 |
CVE-2025-32911 UPD | 6.5 | 9.0 | 0.0095 | 2025-04-15 |
CVE-2022-31627 UPD | 6.3 | 7.7 | 0.0214 | 2022-07-28 |
CVE-2023-25565 UPD | 6.1 | 7.5 | 0.0110 | 2023-02-14 |
CVE-2025-54899 | 5.9 | 7.8 | 0.0058 | 2025-09-09 |
CVE-2026-20810 | 5.9 | 7.8 | 0.0049 | 2026-01-13 |
CVE-2025-42994 UPD | 5.8 | 7.5 | 0.0043 | 2025-06-10 |
CVE-2025-42995 UPD | 5.8 | 7.5 | 0.0041 | 2025-06-10 |
CVE-2021-3939 UPD | 5.5 | 7.8 | 0.0037 | 2021-11-17 |
CVE-2023-22291 UPD | 5.3 | 7.0 | 0.0045 | 2023-04-05 |
CVE-2026-89161 | 5.3 | 7.4 | 0.0013 | 2026-09-11 |
CVE-2021-39218 UPD | 4.8 | 6.3 | 0.0030 | 2021-09-17 |
CVE-2026-106578 | 4.7 | 5.9 | 0.0040 | 2026-10-07 |
CVE-2026-18582 UPD | 4.6 | 5.3 | 0.0086 | 2026-08-03 |
CVE-2026-47328 UPD | 4.5 | 6.1 | 0.0013 | 2026-05-28 |
CVE-2025-42996 UPD | 4.4 | 5.6 | 0.0024 | 2025-06-10 |
CVE-2023-31973 UPD | 4.3 | 5.5 | 0.0031 | 2023-05-09 |
CVE-2025-5899 UPD | 4.1 | 5.3 | 0.0017 | 2025-06-09 |
CVE-2025-7006 UPD | 4.1 | 5.5 | 0.0011 | 2026-06-12 |