Falhas do tipo CWE-416

5.038 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2022-27802HIGHAdobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityEPSS 3.8%CVE-2022-28237HIGHAdobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityEPSS 3.8%CVE-2022-28235HIGHAdobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution VulnerabilityEPSS 3.8%CVE-2022-27801HIGHAdobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityEPSS 3.8%CVE-2021-27646CRITICALUse After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers EPSS 3.8%CVE-2021-34838HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaEPSS 3.8%CVE-2021-34836HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaEPSS 3.8%CVE-2020-8231—Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.EPSS 3.8%CVE-2021-20231—A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequenceEPSS 3.8%CVE-2024-38059HIGHWin32k Elevation of Privilege VulnerabilityEPSS 3.7%CVE-2024-38141HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 3.7%CVE-2022-27789HIGHAdobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution VulnerabilityEPSS 3.7%CVE-2024-38150HIGHWindows DWM Core Library Elevation of Privilege VulnerabilityEPSS 3.7%CVE-2023-0266HIGHUse after free in SNDRV_CTL_IOCTL_ELEM in Linux KernelEPSS 3.7%KEVCVE-2019-6822—A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a speEPSS 3.7%CVE-2021-42721HIGHAdobe Bridge Use After Free could lead to Arbitrary code executionEPSS 3.7%CVE-2021-3518—There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linkEPSS 3.7%CVE-2025-5063HIGHUse after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via aEPSS 3.6%CVE-2022-34223HIGHAdobe Acrobat Reader DC AcroForm currentValueIndices Use-After-Free Remote Code Execution VulnerabilityEPSS 3.6%CVE-2022-34229HIGHAdobe Acrobat Reader DC AcroForm rect Use-After-Free Remote Code Execution VulnerabilityEPSS 3.6%