Weaknesses of type CWE-415

364 results

Uso após liberação de memória

Ocorre quando o código tenta acessar ou manipular um bloco de memória após ele ter sido liberado (freed). O programa perde o controle sobre esse espaço, que pode ser reatribuído a outra estrutura de dados, causando corrupção de memória, travamentos ou execução arbitrária de código.

Example

Um buffer é alocado com malloc(), um ponteiro guarda seu endereço, o buffer é liberado com free(), mas o código continua usando o ponteiro para ler ou escrever dados. Um atacante pode alocar uma estrutura crítica no mesmo endereço e fazer o programa sobrescrever dados sensíveis ou ganhar controle de execução.

How to mitigate

Após liberar memória (free, delete), sempre anule o ponteiro (ptr = NULL) ou use linguagens com gerenciamento automático. Em C/C++, implemente verificações de validade ou use ferramentas como AddressSanitizer durante testes. Prefira smart pointers (unique_ptr, shared_ptr) em C++ moderno.

CVE-2026-77493CRITICALWindows Graphics Component Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-45666HIGHPossible double-free or memory leak in stbi__load_gif_main in stb_imageEPSS 1.0%CVE-2022-23459HIGHDouble free or Use after Free in Value class of JsonxxEPSS 0.9%CVE-2023-24903HIGHWindows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2022-23012—On BIG-IP versions 15.1.x before 15.1.4.1 and 14.1.x before 14.1.4.5, when the HTTP/2 profile is configured on a virtual server, undisclosedEPSS 0.9%CVE-2024-11704CRITICALA double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the sEPSS 0.9%CVE-2023-3312HIGHA vulnerability was found in drivers/cpufreq/qcom-cpufreq-hw.c in cpufreq subsystem in the Linux Kernel. This flaw, during device unbind wilEPSS 0.9%CVE-2026-66373HIGHRedis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE paylEPSS 0.9%CVE-2023-45664HIGHDouble-free in stbi__load_gif_main_outofmem in stb_imageEPSS 0.9%CVE-2026-33630HIGHc-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCPEPSS 0.8%CVE-2025-31241MEDIUMA double free issue was addressed with improved memory management. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS SeqEPSS 0.8%CVE-2021-33304CRITICALDouble Free vulnerability in virtualsquare picoTCP v1.7.0 and picoTCP-NG v2.1 in modules/pico_fragments.c in function pico_fragments_reassemEPSS 0.8%CVE-2026-77504HIGHMicrosoft Office Word Remote Code Execution VulnerabilityEPSS 0.8%CVE-2025-49688HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2020-9859HIGHA memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina EPSS 0.8%KEVCVE-2023-42459HIGHMalformed DATA submessage leads to bad-free error in Fast-DDSEPSS 0.8%CVE-2026-80080HIGHMicrosoft Office Word Remote Code Execution VulnerabilityEPSS 0.8%CVE-2022-29032—A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), TeamcentEPSS 0.8%CVE-2026-69322HIGHMicrosoft Windows Search Component Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2023-36418HIGHAzure RTOS GUIX Studio Remote Code Execution VulnerabilityEPSS 0.8%