Fallos del tipo CWE-416

5042 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2025-27751HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 2.5%CVE-2022-0934HIGHA single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processEPSS 2.5%CVE-2022-46343HIGHA vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to memoEPSS 2.5%CVE-2022-28256MEDIUMAdobe Acrobat Reader DC Annotation Use-After-Free Information Disclosure VulnerabilityEPSS 2.4%CVE-2022-43680HIGHIn libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in ouEPSS 2.4%CVE-2023-36776HIGHWin32k Elevation of Privilege VulnerabilityEPSS 2.4%CVE-2019-5131HIGHAn exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.7.0.29435. A speEPSS 2.4%CVE-2019-18903HIGHwicked: Use-after-free when receiving invalid DHCP6 IA_PD optionEPSS 2.4%CVE-2019-18902HIGHwicked: Use-after-free when receiving invalid DHCP6 client optionsEPSS 2.4%CVE-2022-35670MEDIUMAdobe Acrobat Reader Use-After-Free Memory leakEPSS 2.4%CVE-2022-3199HIGHUse after free in Frames in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 2.4%CVE-2018-19017—Several use after free vulnerabilities have been identified in CX-Supervisor (Versions 3.42 and prior). When processing project files, the aEPSS 2.4%CVE-2025-47175HIGHMicrosoft PowerPoint Remote Code Execution VulnerabilityEPSS 2.4%CVE-2021-31516HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID EPSS 2.4%CVE-2019-5066CRITICALAn exploitable use-after-free vulnerability exists in the way LZW-compressed streams are processed in Aspose.PDF 19.2 for C++. A specially cEPSS 2.4%CVE-2021-46575HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.4%CVE-2020-1983HIGHlibslirp: use after free vulnerability cause a denial of service.EPSS 2.4%CVE-2024-29043HIGHMicrosoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityEPSS 2.4%CVE-2022-26486CRITICALAn unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attaEPSS 2.3%KEVCVE-2024-41869HIGHAcrobat Reader | Use After Free (CWE-416)EPSS 2.3%