Types of Vulnerabilities
Explain various types of vulnerabilities
What you will learn
- Separate vulnerability, threat and risk — the trio most often conflated in the whole syllabus.
- Name the core application flaws: buffer overflow, race condition, and memory injection.
- Explain virtualisation and cloud flaws, and know what VM escape means.
- Understand why end of support is a permanent unpatchable vulnerability, and what to do instead.
Before the types, a trio that must be completely clear: a vulnerability is a weakness present in a system. A threat is what or who might exploit that weakness. Risk is the likelihood of that happening multiplied by its impact. A broken lock is the vulnerability, the burglar is the threat, and the chance of a break-in times the value of what is taken is the risk. A question may describe a vulnerability and ask for the risk, or the reverse.
Application vulnerabilities
| Buffer overflow | Writing more data than the allocated space holds, spilling into adjacent memory. It can be steered into running the attacker's code. |
|---|---|
| Memory injection | Injecting code into the memory space of a running process, so it executes with that process's privileges. |
| Race condition (TOC/TOU) | A gap between time of check and time of use. A file is checked and accepted, then swapped a moment before it is used. |
| Malicious update | An update that looks legitimate and carries a payload. It exploits the trust mechanism, not a technical flaw. |
Web vulnerabilities
| SQL injection (SQLi) | Input treated as part of the database query instead of as data, letting an attacker read or change what is not theirs. |
|---|---|
| Cross-site scripting (XSS) | Script injected into a page and executed in another visitor's browser with their session's privileges. |
Virtualisation and cloud
| VM escape | Breaking out of a virtual machine to the host or another guest. The gravest virtualisation flaw, because it destroys the isolation itself. |
|---|---|
| Resource reuse | Memory or storage reallocated to another tenant without being cleared, leaking residual data. |
| Cloud misconfiguration | A wrong setting opening what should be closed — a publicly readable storage bucket, for instance. The commonest cause of cloud leaks. |
| Virtualization sprawl | Virtual machines created and forgotten, so nothing patches or monitors them. |
Hardware and systems
| Firmware | The hardware's own software. A flaw here is graver because it sits below the operating system and can survive a reinstall. |
|---|---|
| End-of-life (EOL) | A product no longer sold or supported. New flaws in it are never patched. |
| Legacy | An old system still running because the business depends on it, and it cannot be updated. |
| Zero-day | A flaw the vendor does not know about, with no patch. Patching cannot stop it, because there is nothing to apply. |
Known vulnerability vs zero-day
| Known | Zero-day | |
|---|---|---|
| Does the vendor know | Yes, with a published identifier | No |
| Patch | Available — the delay in applying it is the risk | Does not exist |
| Defence | Disciplined patch management | Other layers: isolation, least privilege, behavioural detection |
"Patch it" is not always the answer
If the question says the system is past end of support, or is legacy and cannot be updated, the "apply the patch" option is wrong however right it looks: there is no patch. The answer is a compensating control — network isolation, restricted access, heavier monitoring. A direct link back to objective 1.1.
Current context: the OWASP Top 10
OWASP publishes a list of the ten most critical web application risks; the current edition is 2025, led by broken access control, then security misconfiguration, then software supply chain failures. The list is not CompTIA's taxonomy for this objective — theirs is by location: application, hardware, mobile, virtualisation, OS, cloud, web, supply chain — but knowing what is common in practice helps you read the scenarios.
Real-world example: one flaw, three descriptions
A server runs a library with an unpatched remote code execution flaw, eight months old. The vulnerability: the unpatched library. The threat: any attacker scanning the internet for that version — and there are many, because the identifier is published. The risk: high likelihood (a public exploit exists) against severe impact (the server holds customer data) = a critical risk warranting immediate action. Notice the same description answers three different questions depending on which is asked.
What matters on the exam
- Vulnerability = weakness, threat = actor or event, risk = likelihood × impact. The question gives you one and asks for another.
- Zero-day means there is no patch. Any option proposing an update in response to a zero-day is wrong by definition.
- A race condition is recognised by a description of a gap between a check and an action, not by the phrase being used.
- VM escape means isolation between tenants has collapsed — the gravest thing that can be said in a virtualisation scenario.
Quick check
Answer in your head first, then reveal.
"An unpatched server" — vulnerability, threat, or risk?Reveal the answer
A vulnerability: a weakness present in the system. The attacker who might exploit it is the threat; the likelihood of that times its impact is the risk.
An end-of-support operating system runs a medical device with no replacement. What do you do?Reveal the answer
No patch is possible, so the answer is a compensating control: isolate it on its own segment, restrict what reaches it and what leaves it, monitor it heavily. The long-term plan is replacement.
A program checks a file's permission then opens it a moment later; the file is swapped in between. What is this?Reveal the answer
A race condition, specifically the TOC/TOU pattern: time of check is not time of use, and the attacker works in the gap between them.
Why is a firmware flaw graver than an application flaw?Reveal the answer
Because it sits below the operating system, so it can survive a wipe and reinstall — and security tools that run above the OS may not see it at all.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.