Falhas do tipo CWE-416

5.038 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2021-42779—A heap use after free issue was found in Opensc before version 0.22.0 in sc_file_valid.EPSS 2.1%CVE-2022-42896HIGHInfo Leak in l2cap_core in the Linux KernelEPSS 2.1%CVE-2021-34908HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2023-36735CRITICALMicrosoft Edge (Chromium-based) Elevation of Privilege VulnerabilityEPSS 2.1%CVE-2021-46582HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2021-34917HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2021-34906HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2021-34894HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2021-34911HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2021-34895HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2022-24368LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.1.0.52543. UseEPSS 2.1%CVE-2021-46592HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2021-46587HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2024-38229HIGH.NET and Visual Studio Remote Code Execution VulnerabilityEPSS 2.1%CVE-2021-21061LOWAcrobat Pro DC Use-After-Free Vulnerability Could Lead to Information DisclosureEPSS 2.1%CVE-2024-28888HIGHA use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a checkbox field object. A specially crafted JavascripEPSS 2.1%CVE-2019-5042HIGHAn exploitable Use-After-Free vulnerability exists in the way FunctionType 0 PDF elements are processed in Aspose.PDF 19.2 for C++. A speciaEPSS 2.1%CVE-2023-36741HIGHMicrosoft Edge (Chromium-based) Elevation of Privilege VulnerabilityEPSS 2.1%CVE-2023-31248HIGHLinux Kernel nftables Use-After-Free Local Privilege Escalation VulnerabilityEPSS 2.1%CVE-2021-34891HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%