Weaknesses of type CWE-415

364 results

Uso após liberação de memória

Ocorre quando o código tenta acessar ou manipular um bloco de memória após ele ter sido liberado (freed). O programa perde o controle sobre esse espaço, que pode ser reatribuído a outra estrutura de dados, causando corrupção de memória, travamentos ou execução arbitrária de código.

Example

Um buffer é alocado com malloc(), um ponteiro guarda seu endereço, o buffer é liberado com free(), mas o código continua usando o ponteiro para ler ou escrever dados. Um atacante pode alocar uma estrutura crítica no mesmo endereço e fazer o programa sobrescrever dados sensíveis ou ganhar controle de execução.

How to mitigate

Após liberar memória (free, delete), sempre anule o ponteiro (ptr = NULL) ou use linguagens com gerenciamento automático. Em C/C++, implemente verificações de validade ou use ferramentas como AddressSanitizer durante testes. Prefira smart pointers (unique_ptr, shared_ptr) em C++ moderno.

CVE-2023-45679HIGHAttempt to free an uninitialized memory pointer in vorbis_deinit in stb_vorbisEPSS 0.5%CVE-2026-82677MEDIUMvalkey-io valkey Module Timer module.c moduleTimerHandler double freeEPSS 0.5%CVE-2026-18663MEDIUM389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking controlEPSS 0.5%CVE-2026-55653MEDIUMOpenssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of serviceEPSS 0.5%CVE-2024-20498HIGHMultiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could alEPSS 0.5%CVE-2025-69650HIGHGNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. DurEPSS 0.5%CVE-2024-3187MEDIUMThis issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are causeEPSS 0.5%CVE-2021-25477MEDIUMAn improper error handling in Mediatek RRC Protocol stack prior to SMR Oct-2021 Release 1 allows modem crash and remote denial of service.EPSS 0.5%CVE-2026-64832HIGHFFmpeg 4.4 - 8.1.2 Double-Free in NVDEC Hardware Decoder via nvdec.cEPSS 0.5%CVE-2025-49667HIGHWindows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-33995MEDIUMFreeRDP: Possible double free in kerberos_AcceptSecurityContextEPSS 0.5%CVE-2026-20832HIGHWindows Remote Procedure Call Interface Definition Language (IDL) Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2021-3564—A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI EPSS 0.5%CVE-2024-38157HIGHAzure IoT SDK Remote Code Execution VulnerabilityEPSS 0.5%CVE-2024-45402HIGHPicotls double freeEPSS 0.5%CVE-2026-20338HIGHClamAV ZIP File Format Processing Memory Corruption VulnerabilityEPSS 0.5%CVE-2025-26640HIGHWindows Digital Media Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-81950HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2023-33952MEDIUMKernel: vmwgfx: double free within the handling of vmw_buffer_object objectsEPSS 0.5%CVE-2026-61915MEDIUMAn issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a CyrEPSS 0.5%