Weaknesses of type CWE-416

5,042 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2020-13570HIGHA use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.0.37527. A specially crafted PDFEPSS 2.3%CVE-2020-36329—A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat EPSS 2.3%CVE-2019-5130HIGHAn exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.7.0.29435. A specEPSS 2.3%CVE-2023-44336HIGHTALOS-2023-1794 - Adobe Acrobat Reader Thermometer use-after-free vulnerabilityEPSS 2.3%CVE-2020-1909—A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resEPSS 2.3%CVE-2016-5131HIGHUse-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a deniEPSS 2.3%CVE-2025-30194HIGHDenial of service via crafted DoH exchangeEPSS 2.3%CVE-2024-38199CRITICALWindows Line Printer Daemon (LPD) Service Remote Code Execution VulnerabilityEPSS 2.2%CVE-2021-42383HIGHA use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in theEPSS 2.2%CVE-2023-38238MEDIUMZDI-CAN-21243: Adobe Acrobat Reader DC Font Parsing Use-After-Free Information Disclosure VulnerabilityEPSS 2.2%CVE-2022-40674HIGHlibexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.EPSS 2.2%CVE-2025-62472HIGHWindows Remote Access Connection Manager Elevation of Privilege VulnerabilityEPSS 2.2%CVE-2025-47165HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 2.2%CVE-2024-38159CRITICALWindows Network Virtualization Remote Code Execution VulnerabilityEPSS 2.2%CVE-2023-29328HIGHMicrosoft Teams Remote Code Execution VulnerabilityEPSS 2.2%CVE-2023-44367HIGHZDI-CAN-21929: Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 2.1%CVE-2023-44359HIGHZDI-CAN-21936: Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 2.1%CVE-2025-47917HIGHMbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation.EPSS 2.1%CVE-2025-32709HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 2.1%KEVCVE-2023-44361MEDIUMZDI-CAN-22041: Adobe Acrobat Reader DC AcroForm Doc Object Use-After-Free Information Disclosure VulnerabilityEPSS 2.1%