Fallos del tipo CWE-416

4450 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2019-0708CRITICALA remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attackerEPSS 100.0%KEVCVE-2021-31166CRITICALHTTP Protocol Stack Remote Code Execution VulnerabilityEPSS 99.7%KEVCVE-2015-5119HIGHUse-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296EPSS 99.3%KEVCVE-2010-3962HIGHUse-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors relateEPSS 96.0%KEVCVE-2015-0313HIGHUse-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before EPSS 95.7%KEVCVE-2021-34833HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaEPSS 95.7%CVE-2015-5122HIGHUse-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0EPSS 93.7%KEVCVE-2023-35628HIGHWindows MSHTML Platform Remote Code Execution VulnerabilityEPSS 92.8%CVE-2010-0249HIGHUse-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2EPSS 91.9%KEVCVE-2018-4878HIGHA use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer iEPSS 89.5%KEVCVE-2014-1776CRITICALUse-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denialEPSS 88.0%KEVCVE-2016-9079HIGHA use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild EPSS 87.6%KEVCVE-2020-0674HIGHA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripEPSS 86.9%KEVCVE-2025-49844CRITICALRedis Lua Use-After-Free may lead to remote code executionEPSS 86.8%CVE-2013-3893HIGHUse-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote aEPSS 85.9%KEVCVE-2014-0322HIGHUse-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involvingEPSS 85.2%KEVCVE-2023-29325HIGHWindows OLE Remote Code Execution VulnerabilityEPSS 84.4%CVE-2020-3992CRITICALOpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a EPSS 83.0%KEVCVE-2018-15982HIGHFlash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could EPSS 82.5%KEVCVE-2010-0806HIGHUse-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote atEPSS 82.2%KEV