Falhas do tipo CWE-416

5.040 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2022-0139HIGHUse After Free in radareorg/radare2EPSS 1.2%CVE-2024-25062HIGHAn issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclEPSS 1.2%CVE-2021-3497—GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.EPSS 1.2%CVE-2023-4763HIGHUse after free in Networks in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to potentially exploit heap corruption via a cEPSS 1.2%CVE-2022-31146MEDIUMUse After Free in WasmtimeEPSS 1.2%CVE-2019-19162HIGHA use-after-free vulnerability in the TOBESOFT XPLATFORM versions 9.1 to 9.2.2 may lead to code execution on a system running it.EPSS 1.2%CVE-2024-49106HIGHWindows Remote Desktop Services Remote Code Execution VulnerabilityEPSS 1.2%CVE-2024-49108HIGHWindows Remote Desktop Services Remote Code Execution VulnerabilityEPSS 1.2%CVE-2022-28683HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaEPSS 1.2%CVE-2025-1009CRITICALUse-after-free in XSLTEPSS 1.2%CVE-2021-4154—A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attackerEPSS 1.2%CVE-2023-39453CRITICALA use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1. A specially crafted malformed file EPSS 1.2%CVE-2024-5269HIGHSonos Era 100 SMB2 Message Handling Use-After-Free Remote Code Execution VulnerabilityEPSS 1.2%CVE-2022-29227HIGHUse after free in EnvoyEPSS 1.2%CVE-2025-43434MEDIUMA use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS EPSS 1.2%CVE-2024-3834HIGHUse after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a cEPSS 1.2%CVE-2022-40009CRITICALSWFTools commit 772e55a was discovered to contain a heap-use-after-free via the function grow_unicode at /lib/ttf.c.EPSS 1.2%CVE-2024-3837MEDIUMUse after free in QUIC in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who had compromised the renderer process to potentiEPSS 1.2%CVE-2023-5728HIGHDuring garbage collection extra operations were performed on a object that should not be. This could have led to a potentially exploitable cEPSS 1.2%CVE-2023-5856HIGHUse after free in Side Panel in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UEPSS 1.2%