Weaknesses of type CWE-416

5,042 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2018-9945—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.1%CVE-2018-9967—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 3.1%CVE-2018-9975—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 3.1%CVE-2018-9970—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 3.1%CVE-2018-9944—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.1%CVE-2021-21041HIGHAcrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 3.1%CVE-2021-21039HIGHAcrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 3.1%CVE-2021-21040HIGHAcrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 3.1%CVE-2020-13560HIGHA use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially craftEPSS 3.1%CVE-2019-6773LOWThis vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.1.16828. User iEPSS 3.0%CVE-2020-6819HIGHUnder certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attaEPSS 3.0%KEVCVE-2018-7817—A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when openingEPSS 3.0%CVE-2022-28279HIGHAdobe Photoshop Font Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 3.0%CVE-2017-10959—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interactiEPSS 3.0%CVE-2023-28285HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 3.0%CVE-2021-21708HIGHUAF due to php_filter_float() failingEPSS 3.0%CVE-2025-14765HIGHUse after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 3.0%CVE-2022-2852HIGHUse after free in FedCM in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 3.0%CVE-2019-13514—In Delta Industrial Automation DOPSoft, Version 4.00.06.15 and prior, processing a specially crafted project file may trigger a use-after-frEPSS 3.0%CVE-2021-29256HIGH. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root prEPSS 3.0%KEV