Weaknesses of type CWE-825

91 results

Violação de segurança de memória

É uma categoria genérica que agrupa falhas de gerenciamento de memória — como acesso fora dos limites de buffers, uso após liberação (use-after-free), double-free ou dereferenciação de ponteiros nulos. Essas falhas permitem que um atacante leia, modifique ou execute código arbitrário com acesso direto à memória do processo.

Example

Um programa em C aloca um buffer, libera a memória, mas continua acessando esse endereço em uma operação posterior. Um atacante fornece entrada que dispara esse acesso, causando crash ou permitindo leitura/escrita de dados sensíveis na mesma região de memória agora controlada por ele.

How to mitigate

Use linguagens com coleta automática de lixo (Go, Java, Python) quando viável. Em C/C++, implemente validação rigorosa de limites, use ferramentas como AddressSanitizer em testes, e considere smart pointers. Code review focado em operações de alocação/desalocação é essencial.

CVE-2024-23638MEDIUMSQUID-2023:11 Denial of Service in Cache ManagerEPSS 60.1%CVE-2026-33526CRITICALSquid vulnerable to Denial of Service in ICP Request handlingEPSS 12.8%CVE-2019-15691—TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoderEPSS 4.7%CVE-2023-48316CRITICALAzure RTOS NetX Duo Remote Code Execution VulnerabilityEPSS 4.3%CVE-2023-48315HIGHAzure RTOS NetX Duo Remote Code Execution VulnerabilityEPSS 3.9%CVE-2023-20212HIGHA vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition EPSS 3.4%CVE-2023-48692CRITICALAzure RTOS NetX Duo Remote Code Execution VulnerabilityEPSS 3.1%CVE-2026-45447HIGHHeap Use-After-Free in the PKCS7_verify() FunctionEPSS 2.2%CVE-2024-23310CRITICALA use-after-free vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee11EPSS 1.7%CVE-2021-39228MEDIUMMemory Safety Issue when using patch or merge on state and assign the result back to stateEPSS 1.3%CVE-2023-48694MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 1.3%CVE-2026-6722CRITICALUse-After-Free in SOAP using Apache mapEPSS 1.3%CVE-2023-48697MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 1.2%CVE-2026-3593HIGHHeap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementationEPSS 1.1%CVE-2023-48696MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-48698MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-52924CRITICALsctp: purge outqueue on stale COOKIE-ECHO handlingEPSS 0.8%CVE-2025-49794CRITICALLibxml: heap use after free (uaf) leads to denial of service (dos)EPSS 0.8%CVE-2026-6100CRITICALUse-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressureEPSS 0.8%CVE-2026-44422HIGHFreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusionEPSS 0.7%