The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Primary

Resultant

Insufficient Cleanup

Implementation

Other
Confidentiality
Integrity
Other
Read Application Data
Modify Application Data
DoS: Resource Consumption (Other)
It is possible to overflow the number of temporary files because directories typically have limits on the number of files allowed. This could create a denial of service problem.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

Architecture and Design
Implementation
Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.

Stream resources in a Java application should be released in a finally block, otherwise an exception thrown before the call to close() would result in an unreleased I/O resource. In the example below, the close() method is called in the try block (incorrect).

try {InputStream is = new FileInputStream(path);byte b[] = new byte[is.available()];is.read(b);is.close();} catch (Throwable t) {log.error("Something bad happened: " + t.getMessage());}

CVE-2000-0552
World-readable temporary file not deleted after use.
https://www.cve.org/CVERecord?id=CVE-2000-0552

CVE-2005-2293
Temporary file not deleted after use, leaking database usernames and passwords.
https://www.cve.org/CVERecord?id=CVE-2005-2293

CVE-2002-0788
Interaction error creates a temporary file that can not be deleted due to strong permissions.
https://www.cve.org/CVERecord?id=CVE-2002-0788

CVE-2002-2066
Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
https://www.cve.org/CVERecord?id=CVE-2002-2066

CVE-2002-2067
Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
https://www.cve.org/CVERecord?id=CVE-2002-2067

CVE-2002-2068
Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
https://www.cve.org/CVERecord?id=CVE-2002-2068

CVE-2002-2069
Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
https://www.cve.org/CVERecord?id=CVE-2002-2069

CVE-2002-2070
Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
https://www.cve.org/CVERecord?id=CVE-2002-2070

CVE-2005-1744
Users not logged out when application is restarted after security-relevant changes were made.
https://www.cve.org/CVERecord?id=CVE-2005-1744

File Processing

Incomplete Cleanup

A10
Insecure Configuration Management
CWE More Specific

FIO42-C
Close files when they are no longer needed
CWE More Abstract

MEM31-C
Free dynamically allocated memory when no longer needed
CWE More Abstract

FIO04-J
Release resources when they are no longer needed

FIO00-J
Do not operate on files in shared directories

SFP14
Failure to release resource

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE-459 is a child of CWE-404 because, while CWE-404 covers any type of improper shutdown or release of a resource, CWE-459 deals specifically with a multi-step shutdown process in which a crucial step for "proper" cleanup is omitted or impossible. That is, CWE-459 deals specifically with a cleanup or shutdown process that does not successfully remove all potentially sensitive data.
Overlaps other categories such as permissions and containment. Concept needs further development. This could be primary (e.g. leading to infoleak) or resultant (e.g. resulting from unhandled error conditions or early termination).

PLOVER
2006-07-19
Draft 3
2006-07-19

Sean Eidemiller
Cigital
2008-07-01
added/updated demonstrative examples

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-27
updated Relationship_Notes, Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-06-23
updated Common_Consequences, Other_Notes, Relationship_Notes

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Taxonomy_Mappings

CWE Content Team
MITRE
2019-01-03
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2019-06-20
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Detection_Factors, Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities