Fallos del tipo CWE-416

5043 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2024-49126HIGHWindows Local Security Authority Subsystem Service (LSASS) Remote Code Execution VulnerabilityEPSS 1.3%CVE-2024-49127HIGHWindows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityEPSS 1.3%CVE-2023-38703CRITICALPJSIP has use-after-free vulnerability in SRTP media transportEPSS 1.3%CVE-2023-39453CRITICALA use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1. A specially crafted malformed file EPSS 1.3%CVE-2024-21443HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2022-2585MEDIUMIt was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-afEPSS 1.3%CVE-2022-42719HIGHA use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be useEPSS 1.3%CVE-2025-26671HIGHWindows Remote Desktop Services Remote Code Execution VulnerabilityEPSS 1.3%CVE-2022-2345HIGHUse After Free in vim/vimEPSS 1.3%CVE-2024-47810HIGHA use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a 3D page object. A specially crafted Javascript code iEPSS 1.3%CVE-2024-30082HIGHWin32k Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2022-42716HIGHAn issue was discovered in the Arm Mali GPU Kernel Driver. There is a use-after-free. A non-privileged user can make improper GPU processingEPSS 1.3%CVE-2023-39355HIGHFreeRDP Use-After-Free in RDPGFX_CMDID_RESETGRAPHICSEPSS 1.3%CVE-2025-24064HIGHWindows Domain Name Service Remote Code Execution VulnerabilityEPSS 1.3%CVE-2021-21775MEDIUMA use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A speciallEPSS 1.3%CVE-2024-2176HIGHUse after free in FedCM in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 1.3%CVE-2022-0559HIGHUse After Free in radareorg/radare2EPSS 1.3%CVE-2023-41774HIGHLayer 2 Tunneling Protocol Remote Code Execution VulnerabilityEPSS 1.3%CVE-2022-42705MEDIUMA use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attEPSS 1.3%CVE-2023-41773HIGHLayer 2 Tunneling Protocol Remote Code Execution VulnerabilityEPSS 1.3%