Weaknesses of type CWE-416

5,036 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2012-4787CRITICALUse-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web sitEPSS 17.6%CVE-2019-8605HIGHA use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watcEPSS 17.5%KEVCVE-2025-24085CRITICALA use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS EPSS 17.5%KEVCVE-2021-39842HIGHAdobe Acrobat Reader DC messageHandler.OnMessage Use-After-Free VulnerabilityEPSS 17.4%CVE-2013-0022CRITICALUse-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that EPSS 16.8%CVE-2021-45062HIGHAdobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 16.5%CVE-2022-22620HIGHA use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15EPSS 16.3%KEVCVE-2024-21407HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 16.3%CVE-2021-21796HIGHAn exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can causeEPSS 15.8%CVE-2024-25938HIGHA use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget. A specially crafted JavaScript code iEPSS 15.6%CVE-2024-25648HIGHA use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget. A specially crafted JavaScript code EPSS 15.6%CVE-2016-3189MEDIUMUse-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2EPSS 15.6%CVE-2026-45657CRITICALWindows Kernel Remote Code Execution VulnerabilityEPSS 15.5%CVE-2023-2723HIGHUse after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to poEPSS 15.4%CVE-2015-2360HIGHwin32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1EPSS 14.8%KEVCVE-2022-26485HIGHRemoving an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abEPSS 14.3%KEVCVE-2025-29824HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 13.9%KEVCVE-2021-22940—Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory cEPSS 13.9%CVE-2023-3215HIGHUse after free in WebRTC in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 13.8%CVE-2022-38181HIGHThe Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects BEPSS 13.6%KEV