Fallos del tipo CWE-416

5038 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2024-30006HIGHMicrosoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityEPSS 1.7%CVE-2022-0156MEDIUMUse After Free in vim/vimEPSS 1.7%CVE-2020-27786—A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl comEPSS 1.7%CVE-2023-23392CRITICALHTTP Protocol Stack Remote Code Execution VulnerabilityEPSS 1.7%CVE-2025-48769MEDIUMApache NuttX RTOS: fs/vfs/fs_rename: use after freeEPSS 1.7%CVE-2020-7068MEDIUMUse of freed hash key in the phar_parse_zipfile functionEPSS 1.7%CVE-2021-34301—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll libEPSS 1.7%CVE-2023-28297HIGHWindows Remote Procedure Call Service (RPCSS) Elevation of Privilege VulnerabilityEPSS 1.7%CVE-2021-34298—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll libEPSS 1.7%CVE-2024-38138HIGHWindows Deployment Services Remote Code Execution VulnerabilityEPSS 1.7%CVE-2024-21375HIGHMicrosoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityEPSS 1.7%CVE-2023-24925HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.6%CVE-2024-38107HIGHWindows Power Dependency Coordinator Elevation of Privilege VulnerabilityEPSS 1.6%KEVCVE-2021-4187MEDIUMUse After Free in vim/vimEPSS 1.6%CVE-2018-17909—When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, the application fails to check if it is referencing freed mEPSS 1.6%CVE-2018-18989—In CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior), when processing project fEPSS 1.6%CVE-2024-26186HIGHMicrosoft SQL Server Native Scoring Remote Code Execution VulnerabilityEPSS 1.6%CVE-2021-4173MEDIUMUse After Free in vim/vimEPSS 1.6%CVE-2021-43790HIGHUse After Free in lucetEPSS 1.6%CVE-2022-26717HIGHA use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.EPSS 1.6%