Falhas do tipo CWE-416

5.036 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2020-17410HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaEPSS 9.1%CVE-2020-17417HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.1.35811. User interactioEPSS 9.1%CVE-2020-8265—Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to EPSS 9.0%CVE-2026-33526CRITICALSquid vulnerable to Denial of Service in ICP Request handlingEPSS 8.9%CVE-2026-32748HIGHSquid has Denial of Service in ICP Response handlingEPSS 8.9%CVE-2025-43529HIGHA use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS EPSS 8.8%KEVCVE-2021-44706HIGHAdobe Acrobat Reader Collab.registerReview Use-After-Free Remote Execution VulnerabilityEPSS 8.7%CVE-2021-32589HIGHA Use After Free (CWE-416) vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 andEPSS 8.6%CVE-2024-4671CRITICALUse after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potEPSS 8.3%KEVCVE-2024-46981HIGHRedis' Lua library commands may lead to remote code executionEPSS 8.2%CVE-2024-30089HIGHMicrosoft Streaming Service Elevation of Privilege VulnerabilityEPSS 8.1%CVE-2024-21437HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 8.0%CVE-2025-49724HIGHWindows Connected Devices Platform Service Remote Code Execution VulnerabilityEPSS 8.0%CVE-2021-4102HIGHUse after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 7.8%KEVCVE-2025-21759HIGHipv6: mcast: extend RCU protection in igmp6_send()EPSS 7.8%CVE-2024-20752HIGHZDI-CAN-22653: Adobe Bridge PS File Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 7.8%CVE-2019-13315HIGHThis vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction EPSS 7.7%CVE-2019-13316HIGHThis vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interactEPSS 7.7%CVE-2019-13317HIGHThis vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interactEPSS 7.7%CVE-2021-44705HIGHAdobe Acrobat Reader Use-After-Free could lead to Arbitrary code executionEPSS 7.4%