Weaknesses of type CWE-416

4,450 results

Uso após liberação de memória

Ocorre quando o código tenta acessar um bloco de memória que já foi desalocado (free/delete). O ponteiro continua apontando para aquele endereço, mas o dado ali pode ter sido sobrescrito por outra operação, causando comportamento impredizível, corrupção de dados ou execução de código arbitrário.

Example

Um buffer é alocado, depois liberado com free(). Mais adiante, o código ainda tenta ler ou escrever naquele mesmo ponteiro sem verificar. Se um atacante controlar a alocação subsequente daquele endereço, consegue manipular o conteúdo que será lido.

How to mitigate

Anule o ponteiro imediatamente após liberar (ptr = NULL), implemente análise estática para detectar acessos pós-liberação, use ferramentas como valgrind ou AddressSanitizer nos testes, e considere linguagens com gerenciamento automático de memória para código sensível.

CVE-2019-0708CRITICALA remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attackerEPSS 100.0%KEVCVE-2021-31166CRITICALHTTP Protocol Stack Remote Code Execution VulnerabilityEPSS 99.7%KEVCVE-2015-5119HIGHUse-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296EPSS 99.3%KEVCVE-2010-3962HIGHUse-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors relateEPSS 96.0%KEVCVE-2015-0313HIGHUse-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before EPSS 95.7%KEVCVE-2021-34833HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaEPSS 95.7%CVE-2015-5122HIGHUse-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0EPSS 93.7%KEVCVE-2023-35628HIGHWindows MSHTML Platform Remote Code Execution VulnerabilityEPSS 92.8%CVE-2010-0249HIGHUse-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2EPSS 91.9%KEVCVE-2018-4878HIGHA use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer iEPSS 89.5%KEVCVE-2014-1776CRITICALUse-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denialEPSS 88.0%KEVCVE-2016-9079HIGHA use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild EPSS 87.6%KEVCVE-2020-0674HIGHA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripEPSS 86.9%KEVCVE-2025-49844CRITICALRedis Lua Use-After-Free may lead to remote code executionEPSS 86.8%CVE-2013-3893HIGHUse-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote aEPSS 85.9%KEVCVE-2014-0322HIGHUse-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involvingEPSS 85.2%KEVCVE-2023-29325HIGHWindows OLE Remote Code Execution VulnerabilityEPSS 84.4%CVE-2020-3992CRITICALOpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a EPSS 83.0%KEVCVE-2018-15982HIGHFlash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could EPSS 82.5%KEVCVE-2010-0806HIGHUse-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote atEPSS 82.2%KEV