Weaknesses of type CWE-416

5,042 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2021-31458HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interactioEPSS 2.8%CVE-2016-8623LOWA flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to inEPSS 2.8%CVE-2021-44713MEDIUMAdobe Acrobat Reader DC Use After Free could lead to Application denial-of-serviceEPSS 2.8%CVE-2022-34227HIGHAdobe Acrobat Reader DC AcroForm value Use-After-Free Remote Code Execution VulnerabilityEPSS 2.7%CVE-2020-16017CRITICALUse after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process EPSS 2.7%KEVCVE-2021-45051LOWAdobe Bridge JPEG2000 Parsing Use-After-Free Information Disclosure VulnerabilityEPSS 2.7%CVE-2021-42378HIGHA use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in theEPSS 2.7%CVE-2021-42384HIGHA use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in theEPSS 2.7%CVE-2021-42386HIGHA use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in theEPSS 2.7%CVE-2020-6115HIGHAn exploitable vulnerability exists in the cross-reference table repairing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. WhEPSS 2.7%CVE-2022-1616HIGHUse after free in append_command in vim/vimEPSS 2.7%CVE-2023-26419HIGHZDI-CAN-20274: Adobe Acrobat Reader DC AcroForm removeField Use-After-Free Remote Code Execution VulnerabilityEPSS 2.7%CVE-2022-28849HIGHAdobe Bridge Font Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 2.7%CVE-2023-26420HIGHZDI-CAN-20227: Adobe Acrobat Reader DC AcroForm addField Use-After-Free Remote Code Execution VulnerabilityEPSS 2.7%CVE-2023-26424HIGHZDI-CAN-19833: Adobe Acrobat Reader DC PDF Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 2.7%CVE-2017-1081—In FreeBSD before 11.0-STABLE, 11.0-RELEASE-p10, 10.3-STABLE, and 10.3-RELEASE-p19, ipfilter using "keep state" or "keep frags" options can EPSS 2.7%CVE-2023-26418HIGHZDI-CAN-20311: Adobe Acrobat Reader DC AcroForm exportAsFDFStr Use-After-Free Remote Code Execution VulnerabilityEPSS 2.7%CVE-2024-36971HIGHnet: fix __dst_negative_advice() raceEPSS 2.7%KEVCVE-2022-28838HIGHAdobe Acrobat Pro DC Doc flattenPages Use-After-Free Remote Code Execution VulnerabilityEPSS 2.7%CVE-2023-38230MEDIUMZDI-CAN-21318: Adobe Acrobat Reader DC Font Parsing Use-After-Free Information Disclosure VulnerabilityEPSS 2.7%