CWE-14: Compiler Removal of Code to Clear Buffers
Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka "dead store removal."
10 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2025-64646 — Multiple Vulnerabilities in IBM Concert Software
- CVE-2026-48984 — pam_usb: xfree() does not call explicit_bzero — sensitive cryptographic material may linger in freed heap
Recently published
- CVE-2026-48984 — pam_usb: xfree() does not call explicit_bzero — sensitive cryptographic material may linger in freed heap
- CVE-2025-64646 — Multiple Vulnerabilities in IBM Concert Software