Falhas do tipo CWE-416

6.170 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2021-21193HIGHUse after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafteEPSS 10.0%KEVCVE-2025-49724HIGHWindows Connected Devices Platform Service Remote Code Execution VulnerabilityEPSS 9.8%CVE-2023-5178HIGHKernel: use after free in nvmet_tcp_free_crypto in nvmeEPSS 9.6%CVE-2022-24070—Apache Subversion mod_dav_svn is vulnerable to memory corruptionEPSS 9.5%CVE-2019-7317MEDIUMpng_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.EPSS 9.4%CVE-2021-34486HIGHWindows Event Tracing Elevation of Privilege VulnerabilityEPSS 9.3%KEVCVE-2021-21206HIGHUse after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 9.3%KEVCVE-2024-1670HIGHUse after free in Mojo in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafteEPSS 9.1%CVE-2020-8265—Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to EPSS 9.1%CVE-2026-33526CRITICALSquid vulnerable to Denial of Service in ICP Request handlingEPSS 9.1%CVE-2026-32748HIGHSquid has Denial of Service in ICP Response handlingEPSS 9.1%CVE-2021-32589HIGHA Use After Free (CWE-416) vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 andEPSS 8.9%CVE-2021-44706HIGHAdobe Acrobat Reader Collab.registerReview Use-After-Free Remote Execution VulnerabilityEPSS 8.7%CVE-2026-68820HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 8.6%KEVCVE-2024-4671CRITICALUse after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potEPSS 8.3%KEVCVE-2024-46981HIGHRedis' Lua library commands may lead to remote code executionEPSS 8.2%CVE-2024-30089HIGHMicrosoft Streaming Service Elevation of Privilege VulnerabilityEPSS 8.1%CVE-2024-21437HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 8.0%CVE-2025-6424CRITICALUse-after-free in FontFaceSetEPSS 8.0%CVE-2021-4102HIGHUse after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 7.8%KEV