Fallos del tipo CWE-415

310 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar ou usar um bloco de memória que já foi liberado (free/delete). O programa continua referenciando um ponteiro inválido, levando a comportamento impreditível: corrupção de dados, execução arbitrária ou travamento. É uma das falhas mais críticas em linguagens de baixo nível como C e C++.

Ejemplo

Um serviço web aloca memória para armazenar dados de sessão de um cliente, libera quando a sessão encerra, mas uma thread em segundo plano tenta ler essa sessão novamente sem verificar se ainda é válida. Um atacante pode explorar a corrupção resultante para escrever código malicioso naquele espaço de memória.

Cómo mitigar

Use linguagens com gerenciamento automático de memória (Java, Python, Go) ou, em C/C++, adote práticas rigorosas: evite apontadores brutos, use smart pointers (unique_ptr, shared_ptr), implemente validação antes de acessar memória, e realize testes extensivos com ferramentas como AddressSanitizer e Valgrind.

CVE-2023-25136—OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The dEPSS 89.7%CVE-2018-0101—A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an uEPSS 86.8%CVE-2026-33824CRITICALWindows Internet Key Exchange (IKE) Service Extensions Remote Code Execution VulnerabilityEPSS 55.9%CVE-2021-3407HIGHA flaw was found in mupdf 1.18.0. Double free of object during linearization may lead to memory corruption and other potential consequences.EPSS 50.2%CVE-2026-23918HIGHApache HTTP Server: http2: double free and possible RCE on early resetEPSS 49.7%CVE-2019-11932—A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WEPSS 44.3%CVE-2018-5379HIGHThe Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing clustEPSS 38.5%CVE-2018-4990HIGHAdobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free EPSS 36.6%KEVCVE-2014-0502HIGHDouble free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and bEPSS 24.2%KEVCVE-2009-1544HIGHDouble free vulnerability in the Workstation service in Microsoft Windows allows remote authenticated users to gain privileges via a craftedEPSS 20.6%CVE-2022-4450HIGHDouble free after calling PEM_read_bio_exEPSS 20.4%CVE-2021-21797HIGHAn exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a EPSS 15.0%CVE-2019-5481CRITICALDouble-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.EPSS 7.3%CVE-2022-40304HIGHAn issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading tEPSS 6.8%CVE-2021-22945CRITICALWhen sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freedEPSS 6.7%CVE-2025-62215HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 6.0%KEVCVE-2021-22600MEDIUMDouble Free in net/packet/af_packet.c leading to priviledge escalationEPSS 5.9%KEVCVE-2020-27153HIGHIn BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c. A remote attacker could potentiallyEPSS 4.2%CVE-2019-11049MEDIUMmail() may release string with refcount==1 twiceEPSS 4.2%CVE-2020-9747HIGHDouble-free vulnerability in Adobe Animate 20.5EPSS 4.1%