Falhas do tipo CWE-416

5.041 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2025-32710HIGHWindows Remote Desktop Services Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-0222HIGHUse after free in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker who had compromised the renderer process to potenEPSS 1.1%CVE-2025-43216MEDIUMA use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 1EPSS 1.1%CVE-2024-5688HIGHIf a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant. This vulnerability aEPSS 1.1%CVE-2023-42950HIGHA use after free issue was addressed with improved memory management. This issue is fixed in Safari 17.2, iOS 17.2 and iPadOS 17.2, tvOS 17.EPSS 1.1%CVE-2026-48913HIGHApache HTTP Server: mod_http2 memory corruption when file handles exhaustedEPSS 1.1%CVE-2026-8695HIGHradare2 6.1.5 Use-After-Free via gdbr_threads_list()EPSS 1.1%CVE-2022-34470CRITICALSession history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox < 102, FiEPSS 1.1%CVE-2021-43826HIGHCrash when tunneling TCP over HTTP in EnvoyEPSS 1.1%CVE-2023-25358HIGHA use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.EPSS 1.1%CVE-2022-45406CRITICALIf an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on EPSS 1.1%CVE-2022-3910HIGHUse after free in IO_uring in the Linux KernelEPSS 1.1%CVE-2022-3041HIGHUse after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 1.1%CVE-2023-1829HIGHUse-after-free in tcindex (traffic control index filter) in the Linux KernelEPSS 1.1%CVE-2024-24793HIGHA use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5. A specially crafteEPSS 1.1%CVE-2024-24794HIGHA use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5. A specially crafteEPSS 1.1%CVE-2017-16749—A Use-after-Free issue was discovered in Delta Electronics Delta Industrial Automation Screen Editor, Version 2.00.23.00 or prior. SpeciallyEPSS 1.1%CVE-2023-27379HIGHA use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. By prematurely deletingEPSS 1.1%CVE-2022-40129HIGHA use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDFEPSS 1.1%CVE-2022-32774HIGHA use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By prematurely deletingEPSS 1.1%