CWE-316 (在内存中的明文存储) — Vulnerability Class 27

CWE-316 represents a critical data exposure weakness where applications retain sensitive information in plaintext within volatile memory rather than encrypting or securely obfuscating it. This vulnerability is typically exploited by attackers with local system access who can analyze core dumps, swap files, or memory snapshots to retrieve unencrypted credentials, session tokens, or personal data left behind after processing. Even if the application crashes or the memory is deallocated without explicit zeroing, residual data often persists in swap space or physical memory pages. To mitigate this risk, developers must implement rigorous memory management practices, such as explicitly overwriting sensitive buffers with zeros before freeing them, utilizing secure memory allocation libraries that prevent swapping, and ensuring that sensitive data is never logged or written to disk in its original form.