Falhas do tipo CWE-416

6.168 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2016-7892HIGHAdobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextFieEPSS 19.1%KEVCVE-2015-5123HIGHUse-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.30EPSS 18.8%KEVCVE-2022-27799HIGHAdobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution VulnerabilityEPSS 18.8%CVE-2020-24430HIGHAcrobat Pro DC Use-After-Free vulnerability Could Lead to Arbitrary Code ExecutionEPSS 18.7%CVE-2022-38181HIGHThe Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects BEPSS 18.5%KEVCVE-2022-3842HIGHUse after free in Passwords in Google Chrome prior to 105.0.5195.125 allowed a remote attacker who had compromised the renderer process to pEPSS 18.3%CVE-2019-8605HIGHA use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watcEPSS 17.6%KEVCVE-2012-4787CRITICALUse-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web sitEPSS 17.6%CVE-2025-24085CRITICALA use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS EPSS 17.4%KEVCVE-2021-39842HIGHAdobe Acrobat Reader DC messageHandler.OnMessage Use-After-Free VulnerabilityEPSS 17.4%CVE-2013-0022CRITICALUse-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that EPSS 16.8%CVE-2021-45062HIGHAdobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 16.5%CVE-2022-22620HIGHA use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15EPSS 16.3%KEVCVE-2024-21407HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 16.3%CVE-2021-21796HIGHAn exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can causeEPSS 15.8%CVE-2016-3189MEDIUMUse-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2EPSS 15.7%CVE-2024-25648HIGHA use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget. A specially crafted JavaScript code EPSS 15.6%CVE-2024-25938HIGHA use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget. A specially crafted JavaScript code iEPSS 15.6%CVE-2026-45657CRITICALWindows Kernel Remote Code Execution VulnerabilityEPSS 15.5%CVE-2023-2723HIGHUse after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to poEPSS 15.4%