Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor

When you delete an object through a pointer to its base class, the destructor call must propagate correctly down the inheritance chain. If the child class manages its own resources (like memory, file handles, or network connections) but lacks a virtual destructor, only the parent's destructor will be invoked. This leaves the child's cleanup logic unexecuted, causing resource leaks and leaving the program in an unstable state. While this is fundamentally a reliability issue that can lead to memory leaks (CWE-401), it can become a security vulnerability if an attacker can trigger or exploit the resulting instability. For example, sustained memory leaks can lead to denial of service, and corrupted program state might be leveraged for further attacks. The fix is straightforward: always declare a virtual destructor in any class that is intended to be inherited from, ensuring proper cleanup for all derived types.