Fallos del tipo CWE-416

5038 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2024-43459HIGHSQL Server Native Client Remote Code Execution VulnerabilityEPSS 1.6%CVE-2024-21308HIGHSQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityEPSS 1.6%CVE-2025-21295HIGHSPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution VulnerabilityEPSS 1.6%CVE-2021-34884LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.6%CVE-2023-4806MEDIUMGlibc: potential use-after-free in getaddrinfo()EPSS 1.6%CVE-2021-34886LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.6%CVE-2025-62213HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 1.6%CVE-2024-43533HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 1.6%CVE-2021-41535—A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988), Solid Edge SE2021 EPSS 1.6%CVE-2021-44014HIGHA vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versionsEPSS 1.6%CVE-2025-21334HIGHWindows Hyper-V NT Kernel Integration VSP Elevation of Privilege VulnerabilityEPSS 1.6%KEVCVE-2024-26233HIGHWindows DNS Server Remote Code Execution VulnerabilityEPSS 1.6%CVE-2024-26224HIGHWindows DNS Server Remote Code Execution VulnerabilityEPSS 1.6%CVE-2024-26223HIGHWindows DNS Server Remote Code Execution VulnerabilityEPSS 1.6%CVE-2024-37320HIGHSQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityEPSS 1.6%CVE-2021-1905HIGHPossible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon CompEPSS 1.5%KEVCVE-2021-39835MEDIUMAdobe FrameMaker PDF File Parsing Use-After-Free Information Disclosure VulnerabilityEPSS 1.5%CVE-2022-24061LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. UEPSS 1.5%CVE-2021-3975—A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple thrEPSS 1.5%CVE-2024-4558HIGHUse after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 1.5%