Falhas do tipo CWE-416

5.043 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2023-28287HIGHMicrosoft Publisher Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-50505HIGHWindows Message Queuing Service (MSMQ) Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-31566HIGHPodofo v0.10.0 was discovered to contain a heap-use-after-free via the component PoDoFo::PdfEncrypt::IsMetadataEncrypted().EPSS 0.7%CVE-2023-52266HIGHehttp 1.0.6 before 17405b9 has an epoll_socket.cpp read_func use-after-free. An attacker can make many connections over a short time to trigEPSS 0.7%CVE-2024-0746MEDIUMA Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefox < 122, Firefox ESR EPSS 0.7%CVE-2026-67863HIGHIn open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_locaEPSS 0.7%CVE-2023-0471HIGHUse after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption viaEPSS 0.7%CVE-2024-26241HIGHWin32k Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2022-23584HIGHUse after free in `DecodePng` in TensorflowEPSS 0.7%CVE-2024-22088CRITICALLotos WebServer through 0.1.1 (commit 3eb36cc) has a use-after-free in buffer_avail() at buffer.h via a long URI, because realloc is mishandEPSS 0.7%CVE-2025-60467HIGHA use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allowEPSS 0.7%CVE-2024-5498MEDIUMUse after free in Presentation API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruptionEPSS 0.7%CVE-2023-50716CRITICALInvalid DATA_FRAG Submessage causes a bad-free errorEPSS 0.7%CVE-2026-69530HIGHWindows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-21735HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-77505HIGHWindows DNS Server Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-69546HIGHWindows Active Directory Domain Services Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-69524HIGHWindows Active Directory Domain Services Remote Code Execution VulnerabilityEPSS 0.7%CVE-2022-45748HIGHAn issue was discovered with assimp 5.1.4, a use after free occurred in function ColladaParser::ExtractDataObjectFromChannel in file /code/AEPSS 0.7%CVE-2021-0270HIGHJunos OS: PTX Series, QFX10K Series: A PTX/QFX FPC may restart unexpectedly with the "inline-Jflow" feature enabled on a large-scale deploymentEPSS 0.7%