CWE · MITRE source
CWE-664Improper Control of a Resource Through its Lifetime
The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
Resources often have explicit instructions on how to be created, used and destroyed. When code does not follow these instructions, it can lead to unexpected behaviors and potentially exploitable states. Even without explicit instructions, various principles are expected to be adhered to, such as "Do not use an object until after its creation is complete," or "do not use an object after it has been slated for destruction."
Last updated: 20 August 2026 13:14 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 16 mapping(s) from 4 framework(s): ATT&CK 8 (partial) · CAPEC 5 (partial) · STIG windows server 2016 2 (mostly) · STIG windows server 2019 1 (partial)
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls that address this weakness (3)AI-assisted
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SA-15 | Development Process, Standards, and Tools | SA | Requires a managed development lifecycle process with integrity controls on changes, improving control of resources throughout their lifetime. |
SA-24 | Design For Cyber Resiliency | SA | Requires designing resource lifetime controls that anticipate, withstand, and recover from stresses or attacks, mitigating improper resource control. |
SI-14 | Non-persistence | SI | Directly enforces limited resource lifetime by requiring initiation from a known state and explicit termination, shrinking the window any long-lived resource weakness can be exploited. |
MITRE ATT&CK techniques this weakness enables
Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2022-27518 KEV UPD | 9.9 | 9.8 | 0.0688 | 2022-12-13 |
CVE-2019-5816 UPD | 6.9 | 8.8 | 0.0165 | 2019-06-27 |
CVE-2020-3175 UPD | 6.6 | 8.6 | 0.0197 | 2020-02-26 |
CVE-2026-8517 UPD | 6.6 | 8.8 | 0.0050 | 2026-05-14 |
CVE-2022-20856 UPD | 6.5 | 8.6 | 0.0115 | 2022-09-30 |
CVE-2022-2048 UPD | 6.3 | 7.5 | 0.0227 | 2022-07-07 |
CVE-2022-2191 UPD | 6.2 | 7.5 | 0.0205 | 2022-07-07 |
CVE-2026-43503 UPD | 6.1 | 8.8 | 0.0034 | 2026-05-23 |
CVE-2026-20269 UPD | 6.1 | 8.6 | 0.0027 | 2026-08-05 |
CVE-2016-8763 UPD | 6.0 | 7.8 | 0.0075 | 2017-04-02 |
CVE-2023-44288 UPD | 6.0 | 7.5 | 0.0070 | 2023-12-05 |
CVE-2022-32846 UPD | 5.9 | 7.5 | 0.0062 | 2023-02-27 |
CVE-2024-41169 UPD | 5.9 | 7.5 | 0.0056 | 2025-07-12 |
CVE-2023-52387 UPD | 5.8 | 7.5 | 0.0034 | 2024-02-18 |
CVE-2026-18549 | 5.8 | 7.5 | 0.0034 | 2026-08-15 |
CVE-2026-20158 UPD | 5.7 | 7.5 | 0.0027 | 2026-07-15 |
CVE-2022-31153 UPD | 5.4 | 6.5 | 0.0137 | 2022-07-15 |
CVE-2024-7889 UPD | 5.4 | 7.3 | 0.0025 | 2024-09-11 |
CVE-2022-46144 UPD | 5.3 | 6.5 | 0.0087 | 2022-12-13 |
CVE-2023-25942 UPD | 5.2 | 6.5 | 0.0060 | 2023-04-04 |
CVE-2022-22249 UPD | 5.1 | 6.5 | 0.0046 | 2022-10-18 |
CVE-2022-28287 UPD | 5.1 | 6.5 | 0.0055 | 2022-12-22 |
CVE-2024-37139 UPD | 5.1 | 6.5 | 0.0048 | 2024-06-26 |
CVE-2022-22250 UPD | 5.0 | 6.5 | 0.0030 | 2022-10-18 |
CVE-2025-21593 UPD | 5.0 | 6.5 | 0.0024 | 2025-01-09 |