CWEweakness

CWE-591 Sensitive Data Storage in Improperly Locked Memory

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product stores sensitive data in memory that is not locked, or that has been incorrectly locked.

Common consequences

• Confidentiality: Read Application Data, Read Memory — The memory, including sensitive data, might be written to swap files on disk by the virtual memory manager, possibly making the data more accessible to adversaries.

Potential mitigations

• [Architecture and Design] Identify data that needs to be protected from swapping and choose platform-appropriate protection mechanisms. • [Implementation] When using potentially risky functions such as mlock() or VirtualLock(), check return values to ensure that locking operations are successful.

Observed examples

• CVE-2024-38106: OS kernel stores sensitive data in improperly locked memory, allowing local users to gain privileges by winning a race condition

Related

Observed example · CVE (1)

  • CVE-2024-38106 Windows Kernel Elevation of Privilege Vulnerability vulnerability

Child of · CWE (1)

  • CWE-413 Improper Resource Locking weakness

Referenced by CVE · weakness (77)

  • CVE-2025-11711 There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. vulnerability
  • CVE-2025-48819 Sensitive data storage in improperly locked memory in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to… vulnerability
  • CVE-2025-30394 Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a… vulnerability
  • CVE-2025-26648 Sensitive data storage in improperly locked memory in Windows Kernel allows an authorized attacker to elevate privileges locally. vulnerability
  • CVE-2025-26665 Sensitive data storage in improperly locked memory in Windows upnphost.dll allows an authorized attacker to elevate privileges locally. vulnerability
  • CVE-2025-26671 Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. vulnerability
  • CVE-2025-26686 Sensitive data storage in improperly locked memory in Windows TCP/IP allows an unauthorized attacker to execute code over a network. vulnerability
  • CVE-2025-27471 Sensitive data storage in improperly locked memory in Microsoft Streaming Service allows an unauthorized attacker to deny service over a… vulnerability
  • CVE-2025-27475 Sensitive data storage in improperly locked memory in Windows Update Stack allows an authorized attacker to elevate privileges locally. vulnerability
  • CVE-2025-27482 Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a… vulnerability
  • CVE-2025-27484 Sensitive data storage in improperly locked memory in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to… vulnerability
  • CVE-2025-27732 Sensitive data storage in improperly locked memory in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. vulnerability
  • CVE-2025-24035 Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over… vulnerability
  • CVE-2025-24045 Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over… vulnerability
  • CVE-2025-21224 Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability vulnerability
  • CVE-2025-21294 Microsoft Digest Authentication Remote Code Execution Vulnerability vulnerability
  • CVE-2025-21309 Windows Remote Desktop Services Remote Code Execution Vulnerability vulnerability
  • CVE-2024-49091 Windows Domain Name Service Remote Code Execution Vulnerability vulnerability
  • CVE-2024-49095 Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability vulnerability
  • CVE-2024-49097 Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability vulnerability
  • CVE-2024-49106 Windows Remote Desktop Services Remote Code Execution Vulnerability vulnerability
  • CVE-2024-49108 Windows Remote Desktop Services Remote Code Execution Vulnerability vulnerability
  • CVE-2024-49115 Windows Remote Desktop Services Remote Code Execution Vulnerability vulnerability
  • CVE-2024-49123 Windows Remote Desktop Services Remote Code Execution Vulnerability vulnerability
  • CVE-2024-49126 Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability vulnerability
  • CVE-2024-49128 Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over… vulnerability
  • CVE-2024-49132 Windows Remote Desktop Services Remote Code Execution Vulnerability vulnerability
  • CVE-2024-38264 Microsoft Virtual Hard Disk (VHDX) Denial of Service Vulnerability vulnerability
  • CVE-2024-43633 Windows Hyper-V Denial of Service Vulnerability vulnerability
  • CVE-2024-38262 Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability vulnerability
Show all 77 ›