Fallos del tipo CWE-416

5036 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2020-17410HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaEPSS 9.1%CVE-2020-17417HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.1.35811. User interactioEPSS 9.1%CVE-2020-8265—Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to EPSS 9.0%CVE-2026-33526CRITICALSquid vulnerable to Denial of Service in ICP Request handlingEPSS 8.9%CVE-2026-32748HIGHSquid has Denial of Service in ICP Response handlingEPSS 8.9%CVE-2025-43529HIGHA use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS EPSS 8.8%KEVCVE-2021-44706HIGHAdobe Acrobat Reader Collab.registerReview Use-After-Free Remote Execution VulnerabilityEPSS 8.7%CVE-2021-32589HIGHA Use After Free (CWE-416) vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 andEPSS 8.6%CVE-2024-4671CRITICALUse after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potEPSS 8.3%KEVCVE-2024-46981HIGHRedis' Lua library commands may lead to remote code executionEPSS 8.2%CVE-2024-30089HIGHMicrosoft Streaming Service Elevation of Privilege VulnerabilityEPSS 8.1%CVE-2024-21437HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 8.0%CVE-2025-49724HIGHWindows Connected Devices Platform Service Remote Code Execution VulnerabilityEPSS 8.0%CVE-2021-4102HIGHUse after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 7.8%KEVCVE-2025-21759HIGHipv6: mcast: extend RCU protection in igmp6_send()EPSS 7.8%CVE-2024-20752HIGHZDI-CAN-22653: Adobe Bridge PS File Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 7.8%CVE-2019-13315HIGHThis vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction EPSS 7.7%CVE-2019-13316HIGHThis vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interactEPSS 7.7%CVE-2019-13317HIGHThis vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interactEPSS 7.7%CVE-2021-44705HIGHAdobe Acrobat Reader Use-After-Free could lead to Arbitrary code executionEPSS 7.4%