Fallos del tipo CWE-416

5038 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2022-24103HIGHAdobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityEPSS 3.5%CVE-2025-5068HIGHUse after free in Blink in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 3.5%CVE-2022-34230HIGHAdobe Acrobat Reader Use After Free could lead to Arbitrary code executionEPSS 3.5%CVE-2021-20232CRITICALA flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and otherEPSS 3.4%CVE-2019-5067CRITICALAn uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object pointers. A specially cEPSS 3.4%CVE-2018-16840MEDIUMA heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closingEPSS 3.4%CVE-2024-20729HIGHTALOS-2023-1890 - Adobe Acrobat Reader Annot3D object zoom event use-after-free vulnerabilityEPSS 3.4%CVE-2024-2883HIGHUse after free in ANGLE in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 3.4%CVE-2023-29303MEDIUMZDI-CAN-20970: Adobe Acrobat Reader DC AcroForm Annotation Use-After-Free Information Disclosure VulnerabilityEPSS 3.4%CVE-2019-6763HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interactiEPSS 3.4%CVE-2024-20734MEDIUMZDI-CAN-22516: Adobe Acrobat Pro DC AcroForm Use-After-Free Information Disclosure VulnerabilityEPSS 3.3%CVE-2018-17672—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.3%CVE-2018-17678—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.3%CVE-2018-17674—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.3%CVE-2018-17673—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.3%CVE-2018-17676—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.3%CVE-2018-17675—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.3%CVE-2018-17677—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.3%CVE-2022-34232MEDIUMAdobe Acrobat Reader DC Annotation print Use-After-Free Information Disclosure VulnerabilityEPSS 3.3%CVE-2022-34234MEDIUMAdobe Acrobat Reader DC Doc printWithParams Use-After-Free Information Disclosure VulnerabilityEPSS 3.3%