Weaknesses of type CWE-416

5,110 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2026-7355HIGHUse after free in Media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a EPSS 0.4%CVE-2026-7358HIGHUse after free in Animation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox viEPSS 0.4%CVE-2026-9984HIGHUse after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HEPSS 0.4%CVE-2026-13821HIGHUse after free in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a EPSS 0.4%CVE-2026-8551HIGHUse after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UIEPSS 0.4%CVE-2026-13038HIGHUse after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a craEPSS 0.4%CVE-2026-13031HIGHUse after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a EPSS 0.4%CVE-2024-0813HIGHUse after free in Reading Mode in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extenEPSS 0.4%CVE-2026-0163CRITICALIn multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of prEPSS 0.4%CVE-2026-9957HIGHUse after free in PDF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crEPSS 0.4%CVE-2026-82720MEDIUMUse-after-free in DoH stream cleanup code pathEPSS 0.4%CVE-2026-8849HIGHUse After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation.EPSS 0.4%CVE-2026-17778HIGHUse after free in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox viEPSS 0.4%CVE-2026-79119HIGHUse after free in PDF in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a cEPSS 0.4%CVE-2026-79266HIGHUse after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrEPSS 0.4%CVE-2026-12291HIGHUse-after-free in the Networking: HTTP componentEPSS 0.4%CVE-2026-84350HIGHUse after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrEPSS 0.4%CVE-2026-17875HIGHUse after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a EPSS 0.4%CVE-2026-76017HIGHUse after free in Chromoting in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandboEPSS 0.4%CVE-2026-79219HIGHUse after free in Bluetooth in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitEPSS 0.4%