Fallos del tipo CWE-416

5038 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2022-27802HIGHAdobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityEPSS 3.8%CVE-2022-28237HIGHAdobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityEPSS 3.8%CVE-2022-28235HIGHAdobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution VulnerabilityEPSS 3.8%CVE-2022-27801HIGHAdobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityEPSS 3.8%CVE-2021-27646CRITICALUse After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers EPSS 3.8%CVE-2021-34838HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaEPSS 3.8%CVE-2021-34836HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaEPSS 3.8%CVE-2020-8231—Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.EPSS 3.8%CVE-2021-20231—A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequenceEPSS 3.8%CVE-2024-38059HIGHWin32k Elevation of Privilege VulnerabilityEPSS 3.7%CVE-2024-38141HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 3.7%CVE-2022-27789HIGHAdobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution VulnerabilityEPSS 3.7%CVE-2024-38150HIGHWindows DWM Core Library Elevation of Privilege VulnerabilityEPSS 3.7%CVE-2023-0266HIGHUse after free in SNDRV_CTL_IOCTL_ELEM in Linux KernelEPSS 3.7%KEVCVE-2019-6822—A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a speEPSS 3.7%CVE-2021-42721HIGHAdobe Bridge Use After Free could lead to Arbitrary code executionEPSS 3.7%CVE-2021-3518—There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linkEPSS 3.7%CVE-2025-5063HIGHUse after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via aEPSS 3.6%CVE-2022-34223HIGHAdobe Acrobat Reader DC AcroForm currentValueIndices Use-After-Free Remote Code Execution VulnerabilityEPSS 3.6%CVE-2022-34229HIGHAdobe Acrobat Reader DC AcroForm rect Use-After-Free Remote Code Execution VulnerabilityEPSS 3.6%