Falhas do tipo CWE-416

5.043 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2022-4919HIGHUse after free in Base Internals in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to perform arbitrary read/write via a craEPSS 0.7%CVE-2022-4916HIGHUse after free in Media in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform arbitrary read/write via a crafted HTMLEPSS 0.7%CVE-2022-4918HIGHUse after free in UI in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform arbitrary read/write via a crafted HTML paEPSS 0.7%CVE-2025-24898MEDIUMrust openssl ssl::select_next_proto use after freeEPSS 0.7%CVE-2024-23322HIGHEnvoy crashes when idle and request per try timeout occur within the backoff intervalEPSS 0.7%CVE-2023-36760HIGH3D Viewer Remote Code Execution VulnerabilityEPSS 0.7%CVE-2022-3450HIGHUse after free in Peer Connection in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption EPSS 0.7%CVE-2024-26237HIGHWindows Defender Credential Guard Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2024-43047HIGHUse After Free in DSP ServiceEPSS 0.7%KEVCVE-2023-3389HIGHUse after free in io_uring in the Linux KernelEPSS 0.7%CVE-2023-23421HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2022-4292HIGHUse After Free in vim/vimEPSS 0.7%CVE-2024-7536HIGHUse after free in WebAudio in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crEPSS 0.7%CVE-2024-30807HIGHAn issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in AP4_UnknownAtom::~AP4_UnknownAtom at Ap4Atom.cpp,EPSS 0.7%CVE-2024-30809HIGHAn issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in Ap4Sample.h in AP4_Sample::GetOffset() const, leaEPSS 0.7%CVE-2025-0240MEDIUMCompartment mismatch when parsing JavaScript JSON moduleEPSS 0.7%CVE-2024-43625HIGHMicrosoft Windows VMSwitch Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2023-48231LOWUse-After-Free in win_close() in vimEPSS 0.7%CVE-2021-3929—A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just likeEPSS 0.7%CVE-2024-50286CRITICALksmbd: fix slab-use-after-free in ksmbd_smb2_session_createEPSS 0.7%