Fallos del tipo CWE-416

5042 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2019-0211HIGHIn Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes orEPSS 65.0%KEVCVE-2024-43642HIGHWindows SMB Denial of Service VulnerabilityEPSS 63.1%CVE-2023-49606CRITICALA use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HEPSS 63.1%CVE-2018-9958—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 62.3%CVE-2019-5786MEDIUMObject lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memoryEPSS 62.2%KEVCVE-2021-34847HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaEPSS 61.6%CVE-2023-21608HIGHAdobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution VulnerabilityEPSS 61.5%KEVCVE-2021-22901—curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session tEPSS 60.1%CVE-2019-3829MEDIUMA vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verEPSS 59.0%CVE-2023-36041HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 56.7%CVE-2026-2441HIGHUse after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a craEPSS 55.1%KEVCVE-2021-40728HIGHAdobe Acrobat Reader DC Use After Free Arbitrary Code ExecutionEPSS 54.6%CVE-2016-0984HIGHUse-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2EPSS 54.5%KEVCVE-2021-28640HIGHAdobe Acrobat Reader Use-After-Free Arbitrary Code Execution VulnerabilityEPSS 53.4%CVE-2010-0248HIGHMicrosoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrarEPSS 53.1%CVE-2021-28550CRITICALAdobe Acrobat Reader use after free vulnerability could lead to arbitrary code executionEPSS 52.0%KEVCVE-2021-28635HIGHAdobe Acrobat Reader Use-After-Free VulnerabilityEPSS 51.2%CVE-2021-39840HIGHAdobe Acrobat Reader DC AcroForm Field Use-After-Free Remote Code Execution VulnerabilityEPSS 50.6%CVE-2019-13720HIGHUse after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 49.1%KEVCVE-2020-9715HIGHAdobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier havEPSS 48.6%KEV