Fallos del tipo CWE-416

5043 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2022-3448HIGHUse after free in Permissions API in Google Chrome prior to 106.0.5249.119 allowed a remote attacker who convinced a user to engage in speciEPSS 0.7%CVE-2021-39432MEDIUMdiplib v3.0.0 is vulnerable to Double Free.EPSS 0.7%CVE-2023-33063HIGHUse After Free in DSP ServicesEPSS 0.7%KEVCVE-2024-32974MEDIUMEnvoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()EPSS 0.7%CVE-2023-0472HIGHUse after free in WebRTC in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 0.7%CVE-2025-22040HIGHksmbd: fix session use-after-free in multichannel connectionEPSS 0.7%CVE-2026-70570HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 0.7%CVE-2022-39823HIGHAn issue was discovered in Softing OPC UA C++ SDK 5.66 through 6.x before 6.10. An OPC/UA browse request exceeding the server limit on contiEPSS 0.7%CVE-2025-29823HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.7%CVE-2024-24189CRITICALJsish v3.5.0 (commit 42c694c) was discovered to contain a use-after-free via the SplitChar at ./src/jsiUtils.c.EPSS 0.7%CVE-2026-65343HIGHA use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.EPSS 0.7%CVE-2025-24080HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-24079HIGHMicrosoft Word Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-24081HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-60080HIGHApache Fory: Rust MetaString heap use-after-freeEPSS 0.7%CVE-2024-22267CRITICALVMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. A malicious actor with local administrative pEPSS 0.7%CVE-2025-22041HIGHksmbd: fix use-after-free in ksmbd_sessions_deregister()EPSS 0.7%CVE-2023-25739HIGHModule load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoaEPSS 0.7%CVE-2024-43102CRITICALumtx Kernel panic or Use-After-FreeEPSS 0.7%CVE-2026-50572MEDIUMEnvoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfaultEPSS 0.7%