Fallos del tipo CWE-416

5038 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2022-28842HIGHAdobe Bridge Font Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 3.1%CVE-2018-9969—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 3.1%CVE-2018-9970—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 3.1%CVE-2018-9967—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 3.1%CVE-2018-9968—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 3.1%CVE-2018-9975—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 3.1%CVE-2018-9944—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.1%CVE-2018-9945—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.1%CVE-2021-21039HIGHAcrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 3.1%CVE-2021-21041HIGHAcrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 3.1%CVE-2021-21040HIGHAcrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 3.1%CVE-2020-13560HIGHA use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially craftEPSS 3.1%CVE-2019-6773LOWThis vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.1.16828. User iEPSS 3.0%CVE-2020-6819HIGHUnder certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attaEPSS 3.0%KEVCVE-2018-7817—A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when openingEPSS 3.0%CVE-2017-10959—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interactiEPSS 3.0%CVE-2023-28285HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 3.0%CVE-2021-21708HIGHUAF due to php_filter_float() failingEPSS 3.0%CVE-2025-14765HIGHUse after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 3.0%CVE-2022-2852HIGHUse after free in FedCM in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 3.0%