Weaknesses of type CWE-416

5,042 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2022-28237HIGHAdobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityEPSS 3.8%CVE-2022-28235HIGHAdobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution VulnerabilityEPSS 3.8%CVE-2022-27797HIGHAdobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityEPSS 3.8%CVE-2022-27801HIGHAdobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityEPSS 3.8%CVE-2021-27646CRITICALUse After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers EPSS 3.8%CVE-2021-34836HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaEPSS 3.8%CVE-2021-34838HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaEPSS 3.8%CVE-2020-8231—Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.EPSS 3.8%CVE-2021-20231—A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequenceEPSS 3.8%CVE-2024-38059HIGHWin32k Elevation of Privilege VulnerabilityEPSS 3.7%CVE-2024-38141HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 3.7%CVE-2022-27789HIGHAdobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution VulnerabilityEPSS 3.7%CVE-2024-38150HIGHWindows DWM Core Library Elevation of Privilege VulnerabilityEPSS 3.7%CVE-2023-0266HIGHUse after free in SNDRV_CTL_IOCTL_ELEM in Linux KernelEPSS 3.7%KEVCVE-2019-6822—A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a speEPSS 3.7%CVE-2021-42721HIGHAdobe Bridge Use After Free could lead to Arbitrary code executionEPSS 3.7%CVE-2025-5063HIGHUse after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via aEPSS 3.6%CVE-2022-34223HIGHAdobe Acrobat Reader DC AcroForm currentValueIndices Use-After-Free Remote Code Execution VulnerabilityEPSS 3.6%CVE-2022-34229HIGHAdobe Acrobat Reader DC AcroForm rect Use-After-Free Remote Code Execution VulnerabilityEPSS 3.6%CVE-2023-21688HIGHNT OS Kernel Elevation of Privilege VulnerabilityEPSS 3.6%