Weaknesses of type CWE-825

86 results

Violação de segurança de memória

É uma categoria genérica que agrupa falhas de gerenciamento de memória — como acesso fora dos limites de buffers, uso após liberação (use-after-free), double-free ou dereferenciação de ponteiros nulos. Essas falhas permitem que um atacante leia, modifique ou execute código arbitrário com acesso direto à memória do processo.

Example

Um programa em C aloca um buffer, libera a memória, mas continua acessando esse endereço em uma operação posterior. Um atacante fornece entrada que dispara esse acesso, causando crash ou permitindo leitura/escrita de dados sensíveis na mesma região de memória agora controlada por ele.

How to mitigate

Use linguagens com coleta automática de lixo (Go, Java, Python) quando viável. Em C/C++, implemente validação rigorosa de limites, use ferramentas como AddressSanitizer em testes, e considere smart pointers. Code review focado em operações de alocação/desalocação é essencial.

CVE-2024-23638MEDIUMSQUID-2023:11 Denial of Service in Cache ManagerEPSS 60.1%CVE-2026-33526CRITICALSquid vulnerable to Denial of Service in ICP Request handlingEPSS 8.9%CVE-2026-45447HIGHHeap Use-After-Free in the PKCS7_verify() FunctionEPSS 5.2%CVE-2019-15691—TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoderEPSS 4.7%CVE-2023-48316CRITICALAzure RTOS NetX Duo Remote Code Execution VulnerabilityEPSS 4.3%CVE-2023-48315HIGHAzure RTOS NetX Duo Remote Code Execution VulnerabilityEPSS 3.9%CVE-2023-48692CRITICALAzure RTOS NetX Duo Remote Code Execution VulnerabilityEPSS 3.1%CVE-2023-20212HIGHA vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition EPSS 2.6%CVE-2024-23310CRITICALA use-after-free vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee11EPSS 1.7%CVE-2026-3593HIGHHeap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementationEPSS 1.5%CVE-2021-39228MEDIUMMemory Safety Issue when using patch or merge on state and assign the result back to stateEPSS 1.3%CVE-2023-48694MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 1.3%CVE-2023-48697MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 1.2%CVE-2023-48696MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-48698MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-6722CRITICALUse-After-Free in SOAP using Apache mapEPSS 0.9%CVE-2025-49794CRITICALLibxml: heap use after free (uaf) leads to denial of service (dos)EPSS 0.7%CVE-2024-39792HIGHNGINX Plus MQTT vulnerabilityEPSS 0.6%CVE-2026-24678HIGHFreeRDP has a Heap-use-after-free in cam_v4l_stream_capture_threadEPSS 0.6%CVE-2026-32873HIGHewe: Loop with Unreachable Exit Condition ('Infinite Loop')EPSS 0.6%