CWE · MITRE source
CWE-664Improper Control of a Resource Through its Lifetime
The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
Resources often have explicit instructions on how to be created, used and destroyed. When code does not follow these instructions, it can lead to unexpected behaviors and potentially exploitable states. Even without explicit instructions, various principles are expected to be adhered to, such as "Do not use an object until after its creation is complete," or "do not use an object after it has been slated for destruction."
Last updated: 15 October 2026 14:21 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 3 mapping(s) from 2 framework(s): STIG windows server 2016 2 (mostly) · STIG windows server 2019 1 (partial)
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls PROPOSED for this weakness (3)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SA-15 | Development Process, Standards, and Tools | SA | Requires a managed development lifecycle process with integrity controls on changes, improving control of resources throughout their lifetime. |
SA-24 | Design For Cyber Resiliency | SA | Requires designing resource lifetime controls that anticipate, withstand, and recover from stresses or attacks, mitigating improper resource control. |
SI-14 | Non-persistence | SI | Directly enforces limited resource lifetime by requiring initiation from a known state and explicit termination, shrinking the window any long-lived resource weakness can be exploited. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2022-27518 KEV UPD | 9.9 | 9.8 | 0.0686 | 2022-12-13 |
CVE-2026-20274 UPD | 7.4 | 9.8 | 0.0073 | 2026-09-02 |
CVE-2026-20353 | 7.3 | 9.8 | 0.0040 | 2026-09-14 |
CVE-2026-76500 | 7.2 | 9.8 | 0.0032 | 2026-10-07 |
CVE-2019-5816 UPD | 6.9 | 8.8 | 0.0165 | 2019-06-27 |
CVE-2020-3175 UPD | 6.6 | 8.6 | 0.0197 | 2020-02-26 |
CVE-2026-8517 UPD | 6.6 | 8.8 | 0.0053 | 2026-05-14 |
CVE-2026-43503 UPD | 6.6 | 8.8 | 0.0199 | 2026-05-23 |
CVE-2022-20856 UPD | 6.5 | 8.6 | 0.0128 | 2022-09-30 |
CVE-2026-76282 | 6.5 | 8.8 | 0.0031 | 2026-10-07 |
CVE-2026-20336 | 6.4 | 8.8 | 0.0020 | 2026-09-16 |
CVE-2022-2048 UPD | 6.3 | 7.5 | 0.0256 | 2022-07-07 |
CVE-2022-2191 UPD | 6.2 | 7.5 | 0.0218 | 2022-07-07 |
CVE-2026-20269 UPD | 6.2 | 8.6 | 0.0047 | 2026-08-05 |
CVE-2016-8763 UPD | 6.0 | 7.8 | 0.0075 | 2017-04-02 |
CVE-2023-44288 UPD | 6.0 | 7.5 | 0.0070 | 2023-12-05 |
CVE-2022-32846 UPD | 5.9 | 7.5 | 0.0062 | 2023-02-27 |
CVE-2024-41169 UPD | 5.9 | 7.5 | 0.0069 | 2025-07-12 |
CVE-2026-20158 UPD | 5.9 | 7.5 | 0.0047 | 2026-07-15 |
CVE-2026-18549 UPD | 5.9 | 7.5 | 0.0060 | 2026-08-15 |
CVE-2026-102026 | 5.9 | 7.5 | 0.0046 | 2026-10-14 |
CVE-2023-52387 UPD | 5.8 | 7.5 | 0.0034 | 2024-02-18 |
CVE-2026-76467 | 5.7 | 7.5 | 0.0025 | 2026-10-07 |
CVE-2022-31153 UPD | 5.4 | 6.5 | 0.0146 | 2022-07-15 |
CVE-2024-7889 UPD | 5.4 | 7.3 | 0.0025 | 2024-09-11 |