Class with Virtual Method without a Virtual Destructor

Incomplete Base
Structure: Simple
Description

This occurs when a class defines a virtual method but does not also provide a virtual destructor.

Extended Description

When a base class has virtual methods, it's designed for inheritance and polymorphism. However, if its destructor is not declared virtual, deleting an object through a pointer to its base class leads to undefined behavior. Specifically, only the base class's destructor is called, while the derived class's destructor is skipped. This results in incomplete cleanup, often causing memory leaks and corrupted program states. This reliability flaw can crash an application or create unstable conditions that an attacker might exploit. While not a direct vulnerability, it undermines the program's security posture by introducing unpredictable behavior that could be leveraged in a chain of attacks. To prevent this, any class intended to be inherited from must have a virtual destructor to ensure proper cleanup of all class resources.

Common Consequences 1
Scope: Other

Impact: Reduce Reliability

References 1
Automated Source Code Reliability Measure (ASCRM)
Object Management Group (OMG)
01-2016
ID: REF-961
Taxonomy Mapping
  • OMG ASCRM