Fallos del tipo CWE-416

5038 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2019-19344MEDIUMThere is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x verEPSS 2.8%CVE-2021-36055HIGHXMP Toolkit SDK Use After Free Vulnerability In ReadingXMPNewDOM Could Lead To Arbitrary Code ExecutionEPSS 2.8%CVE-2021-31458HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interactioEPSS 2.8%CVE-2021-31460HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interactioEPSS 2.8%CVE-2016-8623LOWA flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to inEPSS 2.8%CVE-2021-44713MEDIUMAdobe Acrobat Reader DC Use After Free could lead to Application denial-of-serviceEPSS 2.8%CVE-2022-34227HIGHAdobe Acrobat Reader DC AcroForm value Use-After-Free Remote Code Execution VulnerabilityEPSS 2.7%CVE-2020-16017CRITICALUse after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process EPSS 2.7%KEVCVE-2021-45051LOWAdobe Bridge JPEG2000 Parsing Use-After-Free Information Disclosure VulnerabilityEPSS 2.7%CVE-2021-42384HIGHA use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in theEPSS 2.7%CVE-2021-42386HIGHA use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in theEPSS 2.7%CVE-2021-42378HIGHA use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in theEPSS 2.7%CVE-2026-62893CRITICALWindows Deployment Services TFTP Server Remote Code Execution VulnerabilityEPSS 2.7%CVE-2020-6115HIGHAn exploitable vulnerability exists in the cross-reference table repairing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. WhEPSS 2.7%CVE-2022-1616HIGHUse after free in append_command in vim/vimEPSS 2.7%CVE-2022-28849HIGHAdobe Bridge Font Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 2.7%CVE-2023-26420HIGHZDI-CAN-20227: Adobe Acrobat Reader DC AcroForm addField Use-After-Free Remote Code Execution VulnerabilityEPSS 2.7%CVE-2023-26419HIGHZDI-CAN-20274: Adobe Acrobat Reader DC AcroForm removeField Use-After-Free Remote Code Execution VulnerabilityEPSS 2.7%CVE-2023-26424HIGHZDI-CAN-19833: Adobe Acrobat Reader DC PDF Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 2.7%CVE-2017-1081—In FreeBSD before 11.0-STABLE, 11.0-RELEASE-p10, 10.3-STABLE, and 10.3-RELEASE-p19, ipfilter using "keep state" or "keep frags" options can EPSS 2.7%