CWE-591 Sensitive Data Storage in Improperly Locked Memory

variant

The product stores sensitive data in memory that is not locked, or that has been incorrectly locked, which might cause the memory to be written to swap files on disk by the virtual memory manager. This can make the data more accessible to external actors.

parent weaknesses

Broader classes this is a kind of.

CWE-413Improper Resource Locking

vulnerabilities (78)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2024-38106US	—OT critical	6.34% (94th)	KEV	2024-08-13
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-28229US	—OT critical	1.67% (77th)	KEV	2023-04-11
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
CVE-2023-36005US	high8.1	23.9% (98th)	—	2023-12-12
Windows Telephony Server Elevation of Privilege Vulnerability
CVE-2023-36403US	high7.0	0.53% (45th)	—	2023-11-14
Windows Kernel Elevation of Privilege Vulnerability
CVE-2025-30394US	—	34.2% (98th)	—	2025-05-13
Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.
CVE-2025-24035US	—	1.72% (77th)	Exploit	2025-03-11
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
CVE-2025-26686US	—	1.40% (72nd)	Exploit	2025-04-08
Sensitive data storage in improperly locked memory in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
CVE-2023-21766US	—	0.90% (59th)	Exploit	2023-01-10
Windows Overlay Filter Information Disclosure Vulnerability
CVE-2023-21739US	—	0.58% (47th)	Exploit	2023-01-10
Windows Bluetooth Driver Elevation of Privilege Vulnerability
CVE-2025-21309US	—	15.1% (97th)	—	2025-01-14
Windows Remote Desktop Services Remote Code Execution Vulnerability
CVE-2023-28220US	—	15.0% (97th)	—	2023-04-11
Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
CVE-2023-28219US	—	15.0% (97th)	—	2023-04-11
Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
CVE-2023-38159US	—	4.39% (91st)	—	2023-10-10
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2025-27482US	—	1.62% (76th)	—	2025-04-08
Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
CVE-2025-21224US	—	1.94% (80th)	—	2025-01-14
Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability
CVE-2024-49091US	—	1.70% (77th)	—	2024-12-12
Windows Domain Name Service Remote Code Execution Vulnerability
CVE-2025-11711US	—	0.23% (14th)	—	2025-10-14
There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox…
CVE-2025-48819US	—	0.39% (33rd)	—	2025-07-08
Sensitive data storage in improperly locked memory in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges over an adjacent networ…
CVE-2025-27732US	—	0.34% (27th)	—	2025-04-08
Sensitive data storage in improperly locked memory in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVE-2025-27484US	—	0.81% (57th)	—	2025-04-08
Sensitive data storage in improperly locked memory in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges over a network.

source

Where this definition is published.

MITREUS

scry

Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.

Free scan