Fallos del tipo CWE-416

5043 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2024-10827HIGHUse after free in Serial in Google Chrome prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 0.6%CVE-2024-27246MEDIUMZoom Workplace Apps and SDKs - Use After FreeEPSS 0.6%CVE-2022-24050HIGHMariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privEPSS 0.6%CVE-2024-27239MEDIUMZoom Workplace Apps and SDKs - Divide By ZeroEPSS 0.6%CVE-2023-34366HIGHA use-after-free vulnerability exists in the Figure stream parsing functionality of Ichitaro 2023 1.0.1.59372. A specially crafted document EPSS 0.6%CVE-2025-5283MEDIUMUse after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 0.6%CVE-2026-13117MEDIUMAn incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-frEPSS 0.6%CVE-2024-6103HIGHUse after free in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 0.6%CVE-2025-54911HIGHWindows BitLocker Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-41401MEDIUMlibyang - Heap Use-After-Free Write in XML Metadata ParsingEPSS 0.6%CVE-2026-28969HIGHA use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadEPSS 0.6%CVE-2022-45405MEDIUMFreeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free and potentially exploEPSS 0.6%CVE-2024-6989HIGHUse after free in Loader in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 0.6%CVE-2024-6991HIGHUse after free in Dawn in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafteEPSS 0.6%CVE-2023-0931HIGHUse after free in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 0.6%CVE-2025-47168HIGHMicrosoft Word Remote Code Execution VulnerabilityEPSS 0.6%CVE-2023-42104HIGHAshlar-Vellum Cobalt AR File Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 0.6%CVE-2023-42103HIGHAshlar-Vellum Cobalt AR File Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-91087MEDIUMGPAC Compositor media_object.c gf_mo_get_od_id use after freeEPSS 0.6%CVE-2022-3305HIGHUse after free in survey in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruptioEPSS 0.6%