Weaknesses of type CWE-416

5,043 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2025-24898MEDIUMrust openssl ssl::select_next_proto use after freeEPSS 0.7%CVE-2026-50572MEDIUMEnvoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfaultEPSS 0.7%CVE-2022-4918HIGHUse after free in UI in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform arbitrary read/write via a crafted HTML paEPSS 0.7%CVE-2022-4916HIGHUse after free in Media in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform arbitrary read/write via a crafted HTMLEPSS 0.7%CVE-2022-4919HIGHUse after free in Base Internals in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to perform arbitrary read/write via a craEPSS 0.7%CVE-2024-23322HIGHEnvoy crashes when idle and request per try timeout occur within the backoff intervalEPSS 0.7%CVE-2023-36760HIGH3D Viewer Remote Code Execution VulnerabilityEPSS 0.7%CVE-2022-3450HIGHUse after free in Peer Connection in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption EPSS 0.7%CVE-2024-26237HIGHWindows Defender Credential Guard Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2022-4292HIGHUse After Free in vim/vimEPSS 0.7%CVE-2023-3389HIGHUse after free in io_uring in the Linux KernelEPSS 0.7%CVE-2024-43047HIGHUse After Free in DSP ServiceEPSS 0.7%KEVCVE-2023-23421HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2024-7536HIGHUse after free in WebAudio in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crEPSS 0.7%CVE-2024-30807HIGHAn issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in AP4_UnknownAtom::~AP4_UnknownAtom at Ap4Atom.cpp,EPSS 0.7%CVE-2024-30809HIGHAn issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in Ap4Sample.h in AP4_Sample::GetOffset() const, leaEPSS 0.7%CVE-2025-0240MEDIUMCompartment mismatch when parsing JavaScript JSON moduleEPSS 0.7%CVE-2024-43625HIGHMicrosoft Windows VMSwitch Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2023-48231LOWUse-After-Free in win_close() in vimEPSS 0.7%CVE-2021-3929—A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just likeEPSS 0.7%