Weakness (CWE)
CWE-763: Release of Invalid Pointer or Reference
The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
How to prevent it (4 mitigations)
-
Implementation
Only call matching memory management functions. Do not mix and match routines. For example, when you allocate a buffer with malloc(), dispose of the original pointer with free().
-
Implementation
When programming in C++, consider using smart pointers provided by the boost library to help correctly and consistently manage memory.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, glibc in Linux provides protection against free of invalid pointers.
-
Architecture and Design
Use a language that provides abstractions for memory allocation and deallocation.
Source: MITRE CWE-763
46 results · Clear filters · Feed
-
High 8.8
Microsoft Office Excel Remote Code Execution Vulnerability
Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Outlook Remote Code Execution Vulnerability
Release of invalid pointer or reference in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
High 7.2
Windows DHCP Server Remote Code Execution Vulnerability
Release of invalid pointer or reference in Windows DHCP Server allows an authorized attacker to execute code over a network.
-
High 7.0
Windows COM Elevation of Privilege Vulnerability
Release of invalid pointer or reference in Windows COM allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Kernel Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authent…
-
High 7.8
Desktop Window Manager Elevation of Privilege Vulnerability
Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
-
High 7.8
Desktop Window Manager Elevation of Privilege Vulnerability
No cwe for this issue in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Brokering File System Elevation of Privilege Vulnerability
Release of invalid pointer or reference in Windows Brokering File System allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows Performance Monitor Remote Code Execution Vulnerability
Release of invalid pointer or reference in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.
-
High 7.8
Desktop Window Manager Elevation of Privilege Vulnerability
Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows DWM Core Library Elevation of Privilege Vulnerability
Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows DWM Core Library Elevation of Privilege Vulnerability
Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
-
High 8.2
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An att…
-
High 7.8
Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability
Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft Office Excel Remote Code Execution Vulnerability
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
High 7.0
RPC Runtime Elevation of Privilege Vulnerability
Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows DNS Server Remote Code Execution Vulnerability
Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Management Instrumentation Elevation of Privilege Vulnerability
Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
-
High 8.8
Invalid pointer in the JavaScript Engine: JIT component
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
-
High 7.6
An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The v…
-
High 7.8
Windows Device Association Service Elevation of Privilege Vulnerability
Release of invalid pointer or reference in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
-
High 8.5
Libxml2: double-free/uaf in libxml2 python bindings
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-fre…
-
High 8.8
Privilege escalation due to invalid pointer in the Graphics component
Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
-
High 8.8
Privilege escalation due to invalid pointer in the Graphics component
Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
-
High 7.8
Foxit PDF Editor/Reader Annotation Improper Release Vulnerability
When the application opens a PDF file and JavaScript writes annotation attributes, there is a lack of sufficient object type and argument checks. As a result, due to the damage to the internal structure of the annotations, it causes the application to crash d…
-
High 7.8
netfilter: nat: use kfree_rcu to release ops
In the Linux kernel, the following vulnerability has been resolved: netfilter: nat: use kfree_rcu to release ops Florian Westphal says: "Historically this is not an issue, even for normal base hooks: the data path doesn't use the original nf_hook_ops that are…
-
High 7.5
Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws
Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set(…
-
High 7.0
RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before trigg…
-
High 7.8
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y sta…
-
High 7.5
Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests …
-
High 8.7
Micro820®, Micro850®, Micro870® – Specialized Fuzzing Vulnerabilities
A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and …
-
High 8.7
WatchGuard Firebox iked Memory Corruption Vulnerability
A memory corruption vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker to trigger a Denial of Service (DoS) condition in the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway pee…
-
High 7.8
Release of Invalid Pointer or Reference in Android Core
Memory corruption while handling invalid inputs in application info setup.
-
High 8.8
Dell ControlVault3/ControlVault3 Plus cv_close arbitrary free vulnerability
An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an arbitrary free. An attacker can forge a fak…
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.5
Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a segmentation violation v…
-
High 8.8
Leaving pointerlock by pressing the escape key could be prevented
It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a `<select>` element over certain permission prompts. This could be used to confuse a user into giving a site unintended per…
-
High 7.4
A memory corruption vulnerability in HddPassword in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.3…