Weaknesses of type CWE-416

5,042 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2022-34230HIGHAdobe Acrobat Reader Use After Free could lead to Arbitrary code executionEPSS 3.5%CVE-2021-20232CRITICALA flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and otherEPSS 3.4%CVE-2019-5067CRITICALAn uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object pointers. A specially cEPSS 3.4%CVE-2018-16840MEDIUMA heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closingEPSS 3.4%CVE-2024-20729HIGHTALOS-2023-1890 - Adobe Acrobat Reader Annot3D object zoom event use-after-free vulnerabilityEPSS 3.4%CVE-2024-2883HIGHUse after free in ANGLE in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 3.4%CVE-2023-29303MEDIUMZDI-CAN-20970: Adobe Acrobat Reader DC AcroForm Annotation Use-After-Free Information Disclosure VulnerabilityEPSS 3.4%CVE-2019-6763HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interactiEPSS 3.4%CVE-2024-20734MEDIUMZDI-CAN-22516: Adobe Acrobat Pro DC AcroForm Use-After-Free Information Disclosure VulnerabilityEPSS 3.3%CVE-2018-17673—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.3%CVE-2018-17677—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.3%CVE-2018-17675—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.3%CVE-2018-17678—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.3%CVE-2018-17674—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.3%CVE-2018-17672—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.3%CVE-2018-17676—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.3%CVE-2022-34232MEDIUMAdobe Acrobat Reader DC Annotation print Use-After-Free Information Disclosure VulnerabilityEPSS 3.3%CVE-2022-34234MEDIUMAdobe Acrobat Reader DC Doc printWithParams Use-After-Free Information Disclosure VulnerabilityEPSS 3.3%CVE-2018-17618—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interactioEPSS 3.3%CVE-2018-17624—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.1.0.5096. User interactioEPSS 3.3%