Fallos del tipo CWE-416

5036 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2021-30554HIGHUse after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 7.4%KEVCVE-2024-45434CRITICALOpenSynergy BlueSDK (aka Blue SDK) through 6.x has a Use-After-Free. The specific flaw exists within the BlueSDK Bluetooth stack. The issue EPSS 7.2%CVE-2019-5018HIGHAn exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command cEPSS 6.7%CVE-2024-43504HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 6.5%CVE-2022-4379HIGHA use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conEPSS 6.3%CVE-2019-17142HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interacEPSS 6.3%CVE-2021-45063LOWAdobe Acrobat Reader DC JP2 File Parsing Use-After-Free Information Disclosure VulnerabilityEPSS 6.2%CVE-2022-34219HIGHAdobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 6.2%CVE-2022-34216HIGHAdobe Acrobat Reader DC PDF Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 6.2%CVE-2026-68820HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 6.2%KEVCVE-2021-21831HIGHA use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.3.37598. A specially crafted PDFEPSS 6.2%CVE-2020-8857HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interactionEPSS 6.1%CVE-2020-8855HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.2947. User interactEPSS 6.1%CVE-2021-3962—A flaw was found in ImageMagick where it did not properly sanitize certain input before using it to invoke convert processes. This flaw alloEPSS 6.0%CVE-2022-23308HIGHvalid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.EPSS 6.0%CVE-2022-2588MEDIUMIt was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeEPSS 5.9%CVE-2023-35382HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 5.6%CVE-2024-26182HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 5.6%CVE-2021-40726HIGHAdobe Acrobat Reader DC AcroForm Field Use-After-Free Remote Code Execution VulnerabilityEPSS 5.3%CVE-2021-40725HIGHAdobe Acrobat Reader DC AcroForm listbox Use-After-Free Remote Code Execution VulnerabilityEPSS 5.3%