Falhas do tipo CWE-416

5.042 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2022-43641LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 12.0.1.12430. UseEPSS 1.0%CVE-2023-33876HIGHA use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15332 handles destroying annotations. Specially crafted Javascript codeEPSS 1.0%CVE-2024-4948HIGHUse after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafteEPSS 1.0%CVE-2022-43716HIGHA vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-EPSS 1.0%CVE-2026-50432MEDIUMWindow Virtual Filtering Platform (VFP) Denial of Service VulnerabilityEPSS 1.0%CVE-2026-25953MEDIUMFreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (freed appWindow)EPSS 1.0%CVE-2026-25952MEDIUMFreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfoEPSS 1.0%CVE-2024-1059HIGHUse after free in Peer Connection in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit stack corruptionEPSS 1.0%CVE-2025-26630HIGHMicrosoft Access Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-1999MEDIUMUse after free in libwebpEPSS 1.0%CVE-2022-28303HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interactioEPSS 1.0%CVE-2026-3805HIGHuse after free in SMB connection reuseEPSS 1.0%CVE-2024-38249HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2021-29093MEDIUMArcGIS Server image service and raster analytics security update: use-after-freeEPSS 0.9%CVE-2026-29167CRITICALApache HTTP Server: mod_ldap per-dir use-after-freeEPSS 0.9%CVE-2022-23459HIGHDouble free or Use after Free in Value class of JsonxxEPSS 0.9%CVE-2024-4949CRITICALUse after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.9%CVE-2020-4060MEDIUMUse After Free in in cups_update_info in LoRa Basics StationEPSS 0.9%CVE-2022-40960MEDIUMConcurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a potentially exploitaEPSS 0.9%CVE-2022-28641HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. EPSS 0.9%