Weaknesses of type CWE-416

5,043 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2024-38078HIGHXbox Wireless Adapter Remote Code Execution VulnerabilityEPSS 0.7%CVE-2022-3448HIGHUse after free in Permissions API in Google Chrome prior to 106.0.5249.119 allowed a remote attacker who convinced a user to engage in speciEPSS 0.7%CVE-2023-33063HIGHUse After Free in DSP ServicesEPSS 0.7%KEVCVE-2021-39432MEDIUMdiplib v3.0.0 is vulnerable to Double Free.EPSS 0.7%CVE-2024-32974MEDIUMEnvoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()EPSS 0.7%CVE-2023-0472HIGHUse after free in WebRTC in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 0.7%CVE-2025-22040HIGHksmbd: fix session use-after-free in multichannel connectionEPSS 0.7%CVE-2026-70570HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.7%CVE-2022-39823HIGHAn issue was discovered in Softing OPC UA C++ SDK 5.66 through 6.x before 6.10. An OPC/UA browse request exceeding the server limit on contiEPSS 0.7%CVE-2025-29823HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.7%CVE-2024-24189CRITICALJsish v3.5.0 (commit 42c694c) was discovered to contain a use-after-free via the SplitChar at ./src/jsiUtils.c.EPSS 0.7%CVE-2026-65343HIGHA use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.EPSS 0.7%CVE-2025-24080HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-24081HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-24079HIGHMicrosoft Word Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-60080HIGHApache Fory: Rust MetaString heap use-after-freeEPSS 0.7%CVE-2024-22267CRITICALVMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. A malicious actor with local administrative pEPSS 0.7%CVE-2025-22041HIGHksmbd: fix use-after-free in ksmbd_sessions_deregister()EPSS 0.7%CVE-2023-25739HIGHModule load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoaEPSS 0.7%CVE-2024-43102CRITICALumtx Kernel panic or Use-After-FreeEPSS 0.7%