Skip to main content

Improper Clearing of Heap Memory Before Release ('Heap Inspection')

CVE-2025-45663

Medium
6.5/10

Summary

An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event structure.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • LOW

CWE-244 - Improper Clearing of Heap Memory Before Release ('Heap Inspection')

Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.

References

Advisory Timeline

  • Published