Falhas do tipo CWE-415

362 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free, delete). Após a liberação, aquele endereço pode ser reutilizado pelo sistema ou conter lixo, causando comportamento imprevisível, corrupção de dados ou execução de código arbitrário.

Exemplo

Um ponteiro é liberado com free() e depois o código tenta ler ou escrever nele novamente — por exemplo, chamar um método em um objeto deletado em C++, ou acessar um array após liberar sua memória. Um atacante pode explorar isso alocando novamente aquele espaço com dados maliciosos.

Como mitigar

Use linguagens com garbage collection ou gerenciamento automático de memória (Python, Java, Go). Em C/C++, implemente validação rigorosa de ponteiros, use smart pointers (unique_ptr, shared_ptr), defina ponteiros como nullptr após liberar, e revise fluxos de desalocação em código crítico com ferramentas como AddressSanitizer e Valgrind.

CVE-2025-69650HIGHGNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. DurEPSS 0.5%CVE-2024-3187MEDIUMThis issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are causeEPSS 0.5%CVE-2025-49667HIGHWindows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2021-25477MEDIUMAn improper error handling in Mediatek RRC Protocol stack prior to SMR Oct-2021 Release 1 allows modem crash and remote denial of service.EPSS 0.5%CVE-2026-25556MEDIUMMuPDF 1.23.0 through 1.27.0 Barcode Decoding Double FreeEPSS 0.5%CVE-2026-14164HIGHLibarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()EPSS 0.5%CVE-2026-20832HIGHWindows Remote Procedure Call Interface Definition Language (IDL) Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2021-3564—A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI EPSS 0.5%CVE-2024-38157HIGHAzure IoT SDK Remote Code Execution VulnerabilityEPSS 0.5%CVE-2024-45402HIGHPicotls double freeEPSS 0.5%CVE-2026-20338HIGHClamAV ZIP File Format Processing Memory Corruption VulnerabilityEPSS 0.5%CVE-2025-26640HIGHWindows Digital Media Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2023-33952MEDIUMKernel: vmwgfx: double free within the handling of vmw_buffer_object objectsEPSS 0.5%CVE-2026-11576HIGHThe security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanEPSS 0.5%CVE-2020-37239CRITICALlibbabl 0.1.62 Broken Double Free Detection Memory SafetyEPSS 0.5%CVE-2026-20135HIGHCisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service VulnerabilityEPSS 0.5%CVE-2026-66032HIGHlibssh2 Double-Free Heap Corruption via sftp_open()EPSS 0.4%CVE-2025-5262HIGHA double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This couEPSS 0.4%CVE-2024-49095HIGHWindows PrintWorkflowUserSvc Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-26179HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.4%