Home
Trends
Vulnerabilities
News
Researchers
Why dbugs?

Connicpu

#35300of 53,624
7.5Total CVSS
Vulnerabilities · 1
PT-2021-24255
7.5
2021-01-20
Unknown · Derive-Com-Impl · CVE-2021-45681
Name of the Vulnerable Software and Affected Versions: derive-com-impl crate versions prior to 0.1.2 Description: An issue in the derive-com-impl crate can cause an invalid reference and memory corruption because the `AddRef` method might not be called before returning a pointer. The `QueryInterface` method implementation is faulty, as it does not call `IUnknown::AddRef` before returning the pointer, which can lead to an invalid reference when `IUnknown::Release` is called. This is due to the reference count not being incremented as expected. Recommendations: For versions prior to 0.1.2, the only way to quick fix this is to use the macro expanded version of the code and modify the `QueryInterface` method to add the `AddRef` call yourself.