Falhas do tipo CWE-416

5.036 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2012-4787CRITICALUse-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web sitEPSS 17.6%CVE-2019-8605HIGHA use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watcEPSS 17.5%KEVCVE-2025-24085CRITICALA use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS EPSS 17.5%KEVCVE-2021-39842HIGHAdobe Acrobat Reader DC messageHandler.OnMessage Use-After-Free VulnerabilityEPSS 17.4%CVE-2013-0022CRITICALUse-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that EPSS 16.8%CVE-2021-45062HIGHAdobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 16.5%CVE-2022-22620HIGHA use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15EPSS 16.3%KEVCVE-2024-21407HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 16.3%CVE-2021-21796HIGHAn exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can causeEPSS 15.8%CVE-2024-25938HIGHA use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget. A specially crafted JavaScript code iEPSS 15.6%CVE-2024-25648HIGHA use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget. A specially crafted JavaScript code EPSS 15.6%CVE-2016-3189MEDIUMUse-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2EPSS 15.6%CVE-2026-45657CRITICALWindows Kernel Remote Code Execution VulnerabilityEPSS 15.5%CVE-2023-2723HIGHUse after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to poEPSS 15.4%CVE-2015-2360HIGHwin32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1EPSS 14.8%KEVCVE-2022-26485HIGHRemoving an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abEPSS 14.3%KEVCVE-2025-29824HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 13.9%KEVCVE-2021-22940—Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory cEPSS 13.9%CVE-2023-3215HIGHUse after free in WebRTC in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 13.8%CVE-2022-38181HIGHThe Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects BEPSS 13.6%KEV