Falhas do tipo CWE-415

362 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free, delete). Após a liberação, aquele endereço pode ser reutilizado pelo sistema ou conter lixo, causando comportamento imprevisível, corrupção de dados ou execução de código arbitrário.

Exemplo

Um ponteiro é liberado com free() e depois o código tenta ler ou escrever nele novamente — por exemplo, chamar um método em um objeto deletado em C++, ou acessar um array após liberar sua memória. Um atacante pode explorar isso alocando novamente aquele espaço com dados maliciosos.

Como mitigar

Use linguagens com garbage collection ou gerenciamento automático de memória (Python, Java, Go). Em C/C++, implemente validação rigorosa de ponteiros, use smart pointers (unique_ptr, shared_ptr), defina ponteiros como nullptr após liberar, e revise fluxos de desalocação em código crítico com ferramentas como AddressSanitizer e Valgrind.

CVE-2025-13844HIGHCWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD fiEPSS 0.2%CVE-2025-65955MEDIUMImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing familyEPSS 0.2%CVE-2026-11893MEDIUMDouble free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb)EPSS 0.2%CVE-2025-68657MEDIUMespressif/usb_host_hid Double-Free Race Condition in USB Host HID Device Close PathEPSS 0.2%CVE-2025-43282MEDIUMA double free issue was addressed with improved memory management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS SeqEPSS 0.2%CVE-2026-17050MEDIUMDouble free of the USB host configuration descriptor when device enumeration failsEPSS 0.2%CVE-2026-43622HIGHllama.cpp b1886–b7445 Double Free via llama-android.cppEPSS 0.2%CVE-2025-12343LOWFfmpeg: double-free vulnerability in ffmpeg tensorflow dnn backendEPSS 0.2%CVE-2023-25801HIGHTensorFlow has double free in Fractional(Max/Avg)PoolEPSS 0.1%CVE-2026-31053MEDIUMA double free vulnerability exists in librz/bin/format/le/le.c in the function le_load_fixup_record(). When processing malformed or circularEPSS 0.1%CVE-2026-84964HIGHHeap corruption via OCSP request double free from crafted multi-URL certificate in TLS clientEPSS 0.1%CVE-2022-32614MEDIUMIn audio, there is a possible memory corruption due to a logic error. This could lead to local escalation of privilege with System executionEPSS 0.1%CVE-2023-52383MEDIUMDouble-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2026-23868MEDIUMGiflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The condEPSS 0.1%CVE-2023-52384MEDIUMDouble-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2026-56109HIGHALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.cEPSS 0.1%CVE-2025-61145MEDIUMlibtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.EPSS 0.1%CVE-2026-13713MEDIUMYAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stackEPSS 0.1%CVE-2022-25750HIGHMemory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon MobileEPSS 0.1%CVE-2025-13566MEDIUMjarun nnn nnn.c run_cmd_as_plugin double freeEPSS 0.1%