Fallos del tipo CWE-416

6177 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2025-43529HIGHA use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS EPSS 25.7%KEVCVE-2012-1539HIGHUse-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka EPSS 25.4%CVE-2016-7855HIGHUse-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attaEPSS 25.2%KEVCVE-2022-3038HIGHUse after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption vEPSS 24.9%KEVCVE-2023-2725HIGHUse after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extensEPSS 24.7%CVE-2024-26230HIGHWindows Telephony Server Elevation of Privilege VulnerabilityEPSS 24.1%CVE-2025-33071HIGHWindows KDC Proxy Service (KPSSVC) Remote Code Execution VulnerabilityEPSS 23.4%CVE-2024-9680CRITICALAn attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had repEPSS 23.2%KEVCVE-2022-0609HIGHUse after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a cEPSS 22.4%KEVCVE-2021-3518—There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linkEPSS 21.9%CVE-2009-3671HIGHMicrosoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessiEPSS 21.0%CVE-2024-49122HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 20.9%CVE-2021-44701HIGHAdobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution VulnerabilityEPSS 20.9%CVE-2021-30560HIGHUse after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a EPSS 20.4%CVE-2014-8439HIGHAdobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR befEPSS 20.4%KEVCVE-2024-21334CRITICALOpen Management Infrastructure (OMI) Remote Code Execution VulnerabilityEPSS 20.2%CVE-2020-8846HIGHThis vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interactEPSS 19.8%CVE-2020-8856HIGHThis vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25608. User interactEPSS 19.8%CVE-2020-8845HIGHThis vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interactEPSS 19.5%CVE-2025-29824HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 19.3%KEV