CWE-1045 is an object oriented weakness: a parent class has a virtual destructor, but one of its child classes does not. MITRE lists it as a Base weakness without a specific language, though the idea is most familiar from C++.
How it happens
A virtual destructor makes sure that deleting an object through a base class pointer runs the destructor of the actual derived type. If a child class breaks that chain, the child's cleanup might not run.
class Base {
public:
virtual ~Base() {}
};
class Child : public Base {
char *buffer;
public:
Child() : buffer(new char[1024]) {}
// Child's own cleanup is missing or not declared as intended
};
MITRE's consequence is reduced reliability. The child might not perform essential destruction operations. If the relevant code is reachable by an attacker, the reliability problem might introduce a vulnerability, such as a memory leak, which MITRE ties to CWE-401. No CVEs are observed for this entry.
How to find it
MITRE lists no detection methods. Compiler warnings about non virtual destructors in polymorphic classes, and static analysis, will flag many cases. Review class hierarchies where objects are deleted through base pointers.
How to fix it
MITRE lists no formal mitigations. Reasonable steps:
- Declare destructors virtual in every class of a polymorphic hierarchy.
- Release owned resources in the destructor, or use smart pointers and containers that do it for you.
- Turn on compiler warnings for this pattern and treat them as errors in CI.
- Test long running paths for memory growth.
Quick check
Why is a memory leak a security concern?
If an attacker can trigger the code repeatedly, the leak can exhaust memory and cause denial of service.
