Weaknesses of type CWE-416

5,042 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2021-30554HIGHUse after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 7.4%KEVCVE-2024-45434CRITICALOpenSynergy BlueSDK (aka Blue SDK) through 6.x has a Use-After-Free. The specific flaw exists within the BlueSDK Bluetooth stack. The issue EPSS 7.2%CVE-2019-5018HIGHAn exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command cEPSS 6.7%CVE-2024-43504HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 6.5%CVE-2022-4379HIGHA use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conEPSS 6.3%CVE-2019-17142HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interacEPSS 6.3%CVE-2021-45063LOWAdobe Acrobat Reader DC JP2 File Parsing Use-After-Free Information Disclosure VulnerabilityEPSS 6.2%CVE-2022-34216HIGHAdobe Acrobat Reader DC PDF Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 6.2%CVE-2022-34219HIGHAdobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 6.2%CVE-2026-10886CRITICALUse after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via aEPSS 6.2%CVE-2021-21831HIGHA use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.3.37598. A specially crafted PDFEPSS 6.2%CVE-2020-8855HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.2947. User interactEPSS 6.1%CVE-2020-8857HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interactionEPSS 6.1%CVE-2021-3962—A flaw was found in ImageMagick where it did not properly sanitize certain input before using it to invoke convert processes. This flaw alloEPSS 6.0%CVE-2022-2588MEDIUMIt was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeEPSS 5.9%CVE-2023-35382HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 5.6%CVE-2024-26182HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 5.6%CVE-2024-9954HIGHUse after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 5.3%CVE-2021-40726HIGHAdobe Acrobat Reader DC AcroForm Field Use-After-Free Remote Code Execution VulnerabilityEPSS 5.3%CVE-2021-40725HIGHAdobe Acrobat Reader DC AcroForm listbox Use-After-Free Remote Code Execution VulnerabilityEPSS 5.3%