Falhas do tipo CWE-416

5.042 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2022-0615MEDIUMUse-after-free vulnerability in ESET products for LinuxEPSS 0.8%CVE-2023-21747HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2020-14381HIGHA flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their prEPSS 0.8%CVE-2022-3055HIGHUse after free in Passwords in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI EPSS 0.8%CVE-2026-78446MEDIUMWindows Distributed File System (DFS) Denial of Service VulnerabilityEPSS 0.8%CVE-2026-73512HIGHEnvoy: use-after-free in QUIC on internal redirectsEPSS 0.8%CVE-2022-38476HIGHA data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerability. In Firefox, this EPSS 0.8%CVE-2023-42459HIGHMalformed DATA submessage leads to bad-free error in Fast-DDSEPSS 0.8%CVE-2026-50521HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-25087HIGHApache Arrow: Potential use-after-free when reading IPC file with pre-bufferingEPSS 0.8%CVE-2023-34294LOWSante DICOM Viewer Pro DCM File Parsing Use-After-Free Information Disclosure VulnerabilityEPSS 0.8%CVE-2023-1530HIGHUse after free in PDF in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafteEPSS 0.8%CVE-2026-43810CRITICALThe issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOEPSS 0.8%CVE-2021-0920MEDIUMIn unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privEPSS 0.8%KEVCVE-2026-69678HIGHMicrosoft Office PowerPoint Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-32157HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-78525HIGHMicrosoft Office Outlook Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-42985HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-69632HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-57981HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%