CWE-1079, Parent Class without Virtual Destructor Method, describes a parent class that has one or more child classes but no virtual destructor. MITRE lists it as language neutral, though the classic home of this problem is C++.
Unlike many quality entries in this range, MITRE allows CWE-1079 to be used when mapping real vulnerabilities, with the advice to read the name and description carefully before choosing it.
How it happens
A developer writes a base class and several derived classes. Objects are created as the derived type but handled through a pointer to the base. When the last owner deletes the object through that base pointer, C++ needs a virtual destructor to know it must run the derived class destructor first.
Without one, only the base destructor runs. The derived part is never cleaned up properly, and the language standard calls the result undefined behavior.
// Vulnerable pattern: base has no virtual destructor
class Shape {
public:
~Shape() {}
};
class Image : public Shape {
char* pixels;
public:
Image() : pixels(new char[4096]) {}
~Image() { delete[] pixels; }
};
Shape* s = new Image();
delete s; // Image::~Image never runs, pixels leaks
The fix is one keyword.
// Fix: virtual destructor on the base
class Shape {
public:
virtual ~Shape() {}
};
What an attacker gains
MITRE lists the consequence as reduced reliability, from undefined or unexpected behavior. If an attacker can reach the code path that creates and deletes these objects, a reliability problem can become a vulnerability. A leak triggered repeatedly, for example, can exhaust memory in a long running service.
How to find it
MITRE names automated static analysis as a detection method. Compilers can also warn: many C++ compilers offer a warning for deleting through a base pointer when the class has virtual functions but a non virtual destructor. Turn those warnings on and treat them as errors in CI.
How to fix it
- Declare the base class destructor virtual whenever the class is meant to be inherited from.
- If a class is not meant to be a base, mark it final so nobody inherits from it by accident.
- Prefer smart pointers and value types so raw delete calls are rare.
- Review any new class hierarchy for destructor declarations as part of code review.
Quick check
What happens when you delete a derived object through a base pointer with no virtual destructor?
Only the base destructor runs, which is undefined behavior in C++. Resources owned by the derived class may leak.
