Weaknesses of type CWE-416

5,043 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2024-49126HIGHWindows Local Security Authority Subsystem Service (LSASS) Remote Code Execution VulnerabilityEPSS 1.3%CVE-2024-49127HIGHWindows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityEPSS 1.3%CVE-2023-38703CRITICALPJSIP has use-after-free vulnerability in SRTP media transportEPSS 1.3%CVE-2023-39453CRITICALA use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1. A specially crafted malformed file EPSS 1.3%CVE-2024-21443HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2022-2585MEDIUMIt was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-afEPSS 1.3%CVE-2022-42719HIGHA use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be useEPSS 1.3%CVE-2025-26671HIGHWindows Remote Desktop Services Remote Code Execution VulnerabilityEPSS 1.3%CVE-2022-2345HIGHUse After Free in vim/vimEPSS 1.3%CVE-2024-47810HIGHA use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a 3D page object. A specially crafted Javascript code iEPSS 1.3%CVE-2024-30082HIGHWin32k Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2022-42716HIGHAn issue was discovered in the Arm Mali GPU Kernel Driver. There is a use-after-free. A non-privileged user can make improper GPU processingEPSS 1.3%CVE-2023-39355HIGHFreeRDP Use-After-Free in RDPGFX_CMDID_RESETGRAPHICSEPSS 1.3%CVE-2025-24064HIGHWindows Domain Name Service Remote Code Execution VulnerabilityEPSS 1.3%CVE-2021-21775MEDIUMA use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A speciallEPSS 1.3%CVE-2024-2176HIGHUse after free in FedCM in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 1.3%CVE-2022-0559HIGHUse After Free in radareorg/radare2EPSS 1.3%CVE-2023-41774HIGHLayer 2 Tunneling Protocol Remote Code Execution VulnerabilityEPSS 1.3%CVE-2022-42705MEDIUMA use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attEPSS 1.3%CVE-2023-41773HIGHLayer 2 Tunneling Protocol Remote Code Execution VulnerabilityEPSS 1.3%