Falhas do tipo CWE-416

5.041 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2023-1193MEDIUMUse-after-free in setup_async_work()EPSS 1.0%CVE-2025-2476HIGHUse after free in Lens in Google Chrome prior to 134.0.6998.117 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 1.0%CVE-2022-1795HIGHUse After Free in gpac/gpacEPSS 1.0%CVE-2023-5852HIGHUse after free in Printing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI EPSS 1.0%CVE-2025-43438MEDIUMA use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS EPSS 1.0%CVE-2023-36895HIGHMicrosoft Outlook Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-40414CRITICALA use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 10, iOS 17 and iPadOS 17, tvOS 17, macOEPSS 1.0%CVE-2023-36562HIGHMicrosoft Edge (Chromium-based) Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2024-44068HIGHAn issue was discovered in the m2m scaler driver in Samsung Mobile Processor and Wearable Processor Exynos 9820, 9825, 980, 990, 850,and W92EPSS 1.0%CVE-2024-8947MEDIUMMicroPython objarray.c use after freeEPSS 1.0%CVE-2026-62898HIGHMicrosoft QUIC Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-40406HIGHWindows TCP/IP Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-8696HIGHradare2 6.1.5 Use-After-Free via gdbr_pids_list()EPSS 1.0%CVE-2022-37378HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor 11.1.1.53537. User interaEPSS 1.0%CVE-2022-37384HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaEPSS 1.0%CVE-2022-37391HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaEPSS 1.0%CVE-2022-37387HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaEPSS 1.0%CVE-2022-37381HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is requEPSS 1.0%CVE-2022-37390HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaEPSS 1.0%CVE-2022-37385HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaEPSS 1.0%