Fallos del tipo CWE-416

5043 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2025-32710HIGHWindows Remote Desktop Services Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-0222HIGHUse after free in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker who had compromised the renderer process to potenEPSS 1.1%CVE-2025-43216MEDIUMA use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 1EPSS 1.1%CVE-2024-5688HIGHIf a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant. This vulnerability aEPSS 1.1%CVE-2023-42950HIGHA use after free issue was addressed with improved memory management. This issue is fixed in Safari 17.2, iOS 17.2 and iPadOS 17.2, tvOS 17.EPSS 1.1%CVE-2026-48913HIGHApache HTTP Server: mod_http2 memory corruption when file handles exhaustedEPSS 1.1%CVE-2026-8695HIGHradare2 6.1.5 Use-After-Free via gdbr_threads_list()EPSS 1.1%CVE-2022-34470CRITICALSession history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox < 102, FiEPSS 1.1%CVE-2021-43826HIGHCrash when tunneling TCP over HTTP in EnvoyEPSS 1.1%CVE-2023-25358HIGHA use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.EPSS 1.1%CVE-2022-45406CRITICALIf an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on EPSS 1.1%CVE-2022-3910HIGHUse after free in IO_uring in the Linux KernelEPSS 1.1%CVE-2022-3041HIGHUse after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 1.1%CVE-2023-1829HIGHUse-after-free in tcindex (traffic control index filter) in the Linux KernelEPSS 1.1%CVE-2024-24793HIGHA use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5. A specially crafteEPSS 1.1%CVE-2024-24794HIGHA use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5. A specially crafteEPSS 1.1%CVE-2017-16749—A Use-after-Free issue was discovered in Delta Electronics Delta Industrial Automation Screen Editor, Version 2.00.23.00 or prior. SpeciallyEPSS 1.1%CVE-2023-27379HIGHA use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. By prematurely deletingEPSS 1.1%CVE-2022-40129HIGHA use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDFEPSS 1.1%CVE-2022-32774HIGHA use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By prematurely deletingEPSS 1.1%