CWE-1082, Class Instance Self Destruction Control Element, applies when a class instance calls the method or function that deletes or destroys itself. MITRE's example is C++, where delete this makes an object delete itself.
MITRE marks this entry as a quality issue with no direct security implications, and not for mapping real world vulnerabilities.
How it happens
A class decides it is finished, perhaps after handling a callback or closing a connection, and frees itself. It is legal C++ when done with care, but the caller often does not know the object is gone.
// Risky pattern
void Connection::onClose() {
cleanup();
delete this; // any later use of this object is a use after free
}
Anyone still holding a pointer to the connection now holds a dangling pointer. The code after onClose() returns must also never touch a member.
What an attacker gains
MITRE lists reduced reliability, and adds that if the code is reachable by an attacker, the reliability problem might introduce a vulnerability. The honest reading is that self deletion makes lifetime bugs, such as use after free, easier to write.
How to find it
Search for delete this and equivalent self destroy calls in your language. Static analysis can flag them, and review is quick because the pattern is easy to spot.
How to fix it
- Let a clear owner control the lifetime. A smart pointer or container is the usual choice.
- When an object must outlive its own callback, use shared ownership so it is freed only when the last user lets go.
- Document any remaining self deletion and make sure no member is touched afterward.
Quick check
Is delete this always a bug?
No, it can be written correctly. CWE-1082 flags it because it makes object lifetimes harder to reason about and raises the chance of dangling pointers.
