Fallos del tipo CWE-416

5042 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2020-13570HIGHA use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.0.37527. A specially crafted PDFEPSS 2.3%CVE-2020-36329—A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat EPSS 2.3%CVE-2019-5130HIGHAn exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.7.0.29435. A specEPSS 2.3%CVE-2023-44336HIGHTALOS-2023-1794 - Adobe Acrobat Reader Thermometer use-after-free vulnerabilityEPSS 2.3%CVE-2020-1909—A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resEPSS 2.3%CVE-2016-5131HIGHUse-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a deniEPSS 2.3%CVE-2025-30194HIGHDenial of service via crafted DoH exchangeEPSS 2.3%CVE-2024-38199CRITICALWindows Line Printer Daemon (LPD) Service Remote Code Execution VulnerabilityEPSS 2.2%CVE-2021-42383HIGHA use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in theEPSS 2.2%CVE-2023-38238MEDIUMZDI-CAN-21243: Adobe Acrobat Reader DC Font Parsing Use-After-Free Information Disclosure VulnerabilityEPSS 2.2%CVE-2022-40674HIGHlibexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.EPSS 2.2%CVE-2025-62472HIGHWindows Remote Access Connection Manager Elevation of Privilege VulnerabilityEPSS 2.2%CVE-2025-47165HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 2.2%CVE-2024-38159CRITICALWindows Network Virtualization Remote Code Execution VulnerabilityEPSS 2.2%CVE-2023-29328HIGHMicrosoft Teams Remote Code Execution VulnerabilityEPSS 2.2%CVE-2023-44367HIGHZDI-CAN-21929: Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 2.1%CVE-2023-44359HIGHZDI-CAN-21936: Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 2.1%CVE-2025-47917HIGHMbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation.EPSS 2.1%CVE-2025-32709HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 2.1%KEVCVE-2023-44361MEDIUMZDI-CAN-22041: Adobe Acrobat Reader DC AcroForm Doc Object Use-After-Free Information Disclosure VulnerabilityEPSS 2.1%