Weaknesses of type CWE-416

5,043 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2023-51598HIGHHancom Office Word DOC File Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-6241HIGHMali GPU Kernel Driver allows improper GPU memory processing operationsEPSS 0.7%CVE-2022-3304HIGHUse after free in CSS in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.7%CVE-2023-21774HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2023-23514HIGHA use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, iOS EPSS 0.7%CVE-2024-8384CRITICALThe JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two paEPSS 0.7%CVE-2023-32018HIGHWindows Hello Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-29365HIGHWindows Media Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-21235HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-0794HIGHALGO 8180 IP Audio Alerter SIP Use-After-Free Remote Code Execution VulnerabilityEPSS 0.7%CVE-2022-1196MEDIUMAfter a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable EPSS 0.7%CVE-2024-38235MEDIUMWindows Hyper-V Denial of Service VulnerabilityEPSS 0.7%CVE-2023-25735HIGHCross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment EPSS 0.7%CVE-2025-23115CRITICALA Use After Free vulnerability on UniFi Protect Cameras could allow a Remote Code Execution (RCE) by a malicious actor with access to UniFi EPSS 0.7%CVE-2026-73513HIGHEnvoy: oghttp2 upstream trailers incorrect handlingEPSS 0.7%CVE-2024-43556HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2023-5380MEDIUMXorg-x11-server: use-after-free bug in destroywindowEPSS 0.7%CVE-2024-30049HIGHWindows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2021-33796CRITICALIn MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service. EPSS 0.7%CVE-2024-30329LOWFoxit PDF Reader Annotation Use-After-Free Information Disclosure VulnerabilityEPSS 0.7%