Fallos del tipo CWE-416

6177 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2025-21759HIGHipv6: mcast: extend RCU protection in igmp6_send()EPSS 7.8%CVE-2024-20752HIGHZDI-CAN-22653: Adobe Bridge PS File Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 7.8%CVE-2019-13317HIGHThis vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interactEPSS 7.7%CVE-2019-13315HIGHThis vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction EPSS 7.7%CVE-2019-13316HIGHThis vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interactEPSS 7.7%CVE-2024-45434CRITICALOpenSynergy BlueSDK (aka Blue SDK) through 6.x has a Use-After-Free. The specific flaw exists within the BlueSDK Bluetooth stack. The issue EPSS 7.5%CVE-2025-9478HIGHUse after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 7.4%CVE-2021-30554HIGHUse after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 7.4%KEVCVE-2021-44705HIGHAdobe Acrobat Reader Use-After-Free could lead to Arbitrary code executionEPSS 7.3%CVE-2019-5018HIGHAn exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command cEPSS 6.7%CVE-2022-4379HIGHA use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conEPSS 6.6%CVE-2024-43504HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 6.4%CVE-2019-17142HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interacEPSS 6.3%CVE-2022-34216HIGHAdobe Acrobat Reader DC PDF Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 6.2%CVE-2022-34219HIGHAdobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 6.2%CVE-2026-42530CRITICALNGINX Open-Source ngx_http_v3_module vulnerabilityEPSS 6.2%CVE-2021-21831HIGHA use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.3.37598. A specially crafted PDFEPSS 6.1%CVE-2021-45063LOWAdobe Acrobat Reader DC JP2 File Parsing Use-After-Free Information Disclosure VulnerabilityEPSS 6.1%CVE-2020-8857HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interactionEPSS 6.1%CVE-2020-8855HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.2947. User interactEPSS 6.1%