Weaknesses of type CWE-416

5,138 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2026-7985HIGHUse after free in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentiaEPSS 0.3%CVE-2024-39385MEDIUMPremiere Pro | Use After Free (CWE-416)EPSS 0.3%CVE-2026-7922HIGHUse after free in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape viEPSS 0.3%CVE-2024-33010HIGHUse After Free in WLAN HostEPSS 0.3%CVE-2026-11049HIGHUse after free in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandEPSS 0.3%CVE-2026-11060HIGHUse after free in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandEPSS 0.3%CVE-2023-1118HIGHA flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A lEPSS 0.3%CVE-2022-2938—A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by default, it could alloEPSS 0.3%CVE-2026-9993HIGHUse after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potenEPSS 0.3%CVE-2026-11050HIGHUse after free in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.3%CVE-2026-11059HIGHUse after free in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a cEPSS 0.3%CVE-2026-11055HIGHUse after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandEPSS 0.3%CVE-2026-11262HIGHUse after free in TabStrip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML paEPSS 0.3%CVE-2026-11136HIGHUse after free in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a EPSS 0.3%CVE-2022-49412HIGHbfq: Avoid merging queues with different parentsEPSS 0.3%CVE-2026-11164HIGHUse after free in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a cEPSS 0.3%CVE-2026-11125HIGHUse after free in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox vEPSS 0.3%CVE-2026-11130HIGHUse after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a cEPSS 0.3%CVE-2023-0468MEDIUMA use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in the io_uring subcomponent in the Linux Kernel due to a race coEPSS 0.3%CVE-2026-56187HIGHWindows MIDI Service Module Elevation of Privileges VulnerabilityEPSS 0.3%