Weaknesses of type CWE-416

6,177 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2021-21193HIGHUse after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafteEPSS 10.0%KEVCVE-2025-49724HIGHWindows Connected Devices Platform Service Remote Code Execution VulnerabilityEPSS 9.8%CVE-2023-5178HIGHKernel: use after free in nvmet_tcp_free_crypto in nvmeEPSS 9.6%CVE-2019-7317MEDIUMpng_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.EPSS 9.4%CVE-2021-34486HIGHWindows Event Tracing Elevation of Privilege VulnerabilityEPSS 9.3%KEVCVE-2021-21206HIGHUse after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 9.3%KEVCVE-2024-1670HIGHUse after free in Mojo in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafteEPSS 9.1%CVE-2020-8265—Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to EPSS 9.1%CVE-2026-33526CRITICALSquid vulnerable to Denial of Service in ICP Request handlingEPSS 9.1%CVE-2026-32748HIGHSquid has Denial of Service in ICP Response handlingEPSS 9.1%CVE-2021-32589HIGHA Use After Free (CWE-416) vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 andEPSS 8.9%CVE-2022-24070—Apache Subversion mod_dav_svn is vulnerable to memory corruptionEPSS 8.9%CVE-2026-68820HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 8.6%KEVCVE-2021-44706HIGHAdobe Acrobat Reader Collab.registerReview Use-After-Free Remote Execution VulnerabilityEPSS 8.5%CVE-2024-4671CRITICALUse after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potEPSS 8.3%KEVCVE-2024-46981HIGHRedis' Lua library commands may lead to remote code executionEPSS 8.2%CVE-2024-30089HIGHMicrosoft Streaming Service Elevation of Privilege VulnerabilityEPSS 8.1%CVE-2024-21437HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 8.0%CVE-2025-6424CRITICALUse-after-free in FontFaceSetEPSS 7.9%CVE-2021-4102HIGHUse after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 7.8%KEV