Weaknesses of type CWE-416

5,043 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2024-49132HIGHWindows Remote Desktop Services Remote Code Execution VulnerabilityEPSS 1.1%CVE-2023-21679HIGHWindows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution VulnerabilityEPSS 1.1%CVE-2026-20854HIGHWindows Local Security Authority Subsystem Service (LSASS) Remote Code Execution VulnerabilityEPSS 1.1%CVE-2025-49735HIGHWindows KDC Proxy Service (KPSSVC) Remote Code Execution VulnerabilityEPSS 1.1%CVE-2025-21366HIGHMicrosoft Access Remote Code Execution VulnerabilityEPSS 1.1%CVE-2023-4211MEDIUMMali GPU Kernel Driver Allows Improper GPU Memory Processing OperationsEPSS 1.1%KEVCVE-2022-0523HIGHUse After Free in radareorg/radare2EPSS 1.1%CVE-2024-49142HIGHMicrosoft Access Remote Code Execution VulnerabilityEPSS 1.1%CVE-2022-43639HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 12.0.1.12430. User interaEPSS 1.1%CVE-2022-43637HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 12.0.1.12430. User interaEPSS 1.1%CVE-2022-43638HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 12.0.1.12430. User interaEPSS 1.1%CVE-2026-3593HIGHHeap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementationEPSS 1.1%CVE-2025-27745HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 1.1%CVE-2025-27749HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-4368MEDIUMUse after free in Dawn in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 1.1%CVE-2025-27748HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 1.1%CVE-2022-3196HIGHUse after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafteEPSS 1.1%CVE-2023-1194HIGHUse-after-free in parse_lease_state()EPSS 1.1%CVE-2022-3197HIGHUse after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafteEPSS 1.1%CVE-2021-33480—An use-after-free vulnerability was discovered in gocr through 0.53-20200802 in context_correction() in pgm2asc.c.EPSS 1.1%