Falhas do tipo CWE-416

5.040 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2021-36980MEDIUMOpen vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_dEPSS 1.2%CVE-2022-24791HIGHUse after free in WasmtimeEPSS 1.2%CVE-2024-31578HIGHFFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.EPSS 1.2%CVE-2024-56171HIGHlibxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlscEPSS 1.2%CVE-2024-35955HIGHkprobes: Fix possible use-after-free issue on kprobe registrationEPSS 1.2%CVE-2024-49069HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 1.2%CVE-2021-32613—In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS.EPSS 1.2%CVE-2024-49128HIGHWindows Remote Desktop Services Remote Code Execution VulnerabilityEPSS 1.2%CVE-2011-1236HIGHUse-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows EPSS 1.2%CVE-2022-1114—A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an atEPSS 1.2%CVE-2026-63639HIGHValkey: UAF in stream deserialization may lead to remote code executionEPSS 1.2%CVE-2022-1011—A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gEPSS 1.2%CVE-2021-47378CRITICALnvme-rdma: destroy cm id before destroy qp to avoid use after freeEPSS 1.2%CVE-2024-43574HIGHMicrosoft Speech Application Programming Interface (SAPI) Remote Code Execution VulnerabilityEPSS 1.2%CVE-2021-41539—A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnEPSS 1.2%CVE-2011-1874HIGHUse-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows EPSS 1.2%CVE-2021-47323HIGHwatchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff()EPSS 1.2%CVE-2021-47324HIGHwatchdog: Fix possible use-after-free in wdt_startup()EPSS 1.2%CVE-2021-41536—A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnEPSS 1.2%CVE-2021-41540—A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnEPSS 1.2%