What CVEs are caused by CWE-765?

1 recorded CVEs are attributed to CWE-765, including CVE-2024-49602.

What are the consequences of CWE-765?

Exploiting CWE-765 can lead to: DoS: Crash, Exit, or Restart, Modify Memory, Unexpected State.

Is CWE-765 actively exploited?

1 recorded CVEs are caused by CWE-765; none are currently in CISA's KEV catalog of actively exploited flaws.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Base weakness

Incomplete

CWE-765: Multiple Unlocks of a Critical Resource

The product unlocks a critical resource more times than intended, leading to an unexpected state in the system.

Last updated May 1, 2026

1

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

When the product is operating in a concurrent environment and repeatedly unlocks a critical resource, the consequences will vary based on the type of lock, the lock's implementation, and the resource being protected. In some situations such as with semaphores, the resources are pooled and extra calls to unlock will increase the count for the number of available resources, likely resulting in a crash or unpredictable behavior when the system nears capacity.

Real-world CVEs

1 recorded CVEs are caused by CWE-765 (Multiple Unlocks of a Critical Resource). The highest-severity and most recent are shown first.

CVE-2024-49602
Medium · CVSS 6.5 · EPSS 28th
2024-12-09

Common consequences

What can happen when CWE-765 is exploited.

DoS: Crash, Exit, or Restart, Modify Memory, Unexpected State

Affects: Availability, Integrity

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

How to prevent it

Practical mitigations for CWE-765, grouped by where in the lifecycle they apply.

Implementation

When locking and unlocking a resource, try to be sure that all control paths through the code in which the resource is locked one or more times correspond to exactly as many unlocks. If the product acquires a lock and then determines it is not able to perform its intended behavior, be sure to release the lock(s) before waiting for conditions to improve. Reacquire the lock(s) before trying again.

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2009-0935 — Attacker provides invalid address to a memory-reading function, causing a mutex to be unlocked twice

Terminology & mappings

Mapped taxonomies

Software Fault Patterns: Multiple locks/unlocks (SFP21)

Frequently asked questions

Common questions about CWE-765.

What is CWE-765?: The product unlocks a critical resource more times than intended, leading to an unexpected state in the system.
What CVEs are caused by CWE-765?: 1 recorded CVEs are attributed to CWE-765, including CVE-2024-49602.
How do you prevent CWE-765?: When locking and unlocking a resource, try to be sure that all control paths through the code in which the resource is locked one or more times correspond to exactly as many unlocks. If the product acquires a lock and then determines it is not able to perform its intended behavior, be sure to release the lock(s) before waiting for conditions to improve. Reacquire the lock(s) before trying again.
How is CWE-765 detected?: Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
What are the consequences of CWE-765?: Exploiting CWE-765 can lead to: DoS: Crash, Exit, or Restart, Modify Memory, Unexpected State.
Is CWE-765 actively exploited?: 1 recorded CVEs are caused by CWE-765; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-765

Get alerted the moment a new CWE-765 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing