Falhas do tipo CWE-416

5.042 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2021-21417HIGHUse after free in fluidsynthEPSS 0.9%CVE-2022-2858HIGHUse after free in Sign-In Flow in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption viaEPSS 0.9%CVE-2026-45185CRITICALExim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggeredEPSS 0.9%CVE-2026-28387HIGHPotential Use-after-free in DANE Client CodeEPSS 0.9%CVE-2023-3214HIGHUse after free in Autofill payments in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruptioEPSS 0.9%CVE-2025-21387HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-21784HIGH3D Builder Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-1077HIGHUse after free in Network in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a maEPSS 0.9%CVE-2023-38160MEDIUMWindows TCP/IP Information Disclosure VulnerabilityEPSS 0.9%CVE-2022-2855HIGHUse after free in ANGLE in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 0.9%CVE-2024-43463HIGHMicrosoft Office Visio Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-32033MEDIUMMicrosoft Failover Cluster Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-13368CRITICALWatchGuard Firebox Race Condition and Use-After-Free in Mobile VPN with IKEv2 LDAP AuthenticationEPSS 0.9%CVE-2023-32134HIGHSante DICOM Viewer Pro DCM File Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-38139HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2023-2203HIGHA flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows aEPSS 0.9%CVE-2025-21362HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.9%CVE-2025-27578HIGHPixmeo OsiriX MD Use After FreeEPSS 0.9%CVE-2024-38171HIGHMicrosoft PowerPoint Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-30326HIGHFoxit PDF Reader Doc Object Use-After-Free Remote Code Execution VulnerabilityEPSS 0.9%