Falhas do tipo CWE-416

4.450 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar (ler ou escrever) um bloco de memória que já foi liberado (free, delete). O programa mantém um ponteiro para a memória, mas o sistema operacional pode reatribuir essa região para outro uso, causando corrupção de dados, travamento ou execução de código arbitrário.

Exemplo

Um servidor web aloca memória para armazenar dados de sessão do usuário, depois libera essa memória quando a sessão encerra. Se uma thread continuar tentando acessar essa sessão após a liberação, pode ler dados de outra sessão ou sobrescrever dados críticos de outro processo.

Como mitigar

Sempre anule ponteiros após liberar memória (ptr = NULL), use variáveis de controle para rastrear estado de alocação, implemente gerenciamento automático de memória quando possível (smart pointers em C++), e execute testes com sanitizers (AddressSanitizer, Valgrind) durante desenvolvimento e CI/CD.

CVE-2019-0708CRITICALA remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attackerEPSS 100.0%KEVCVE-2021-31166CRITICALHTTP Protocol Stack Remote Code Execution VulnerabilityEPSS 99.7%KEVCVE-2015-5119HIGHUse-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296EPSS 99.3%KEVCVE-2010-3962HIGHUse-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors relateEPSS 96.0%KEVCVE-2015-0313HIGHUse-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before EPSS 95.7%KEVCVE-2021-34833HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaEPSS 95.7%CVE-2015-5122HIGHUse-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0EPSS 93.7%KEVCVE-2023-35628HIGHWindows MSHTML Platform Remote Code Execution VulnerabilityEPSS 92.8%CVE-2010-0249HIGHUse-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2EPSS 91.9%KEVCVE-2018-4878HIGHA use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer iEPSS 89.5%KEVCVE-2014-1776CRITICALUse-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denialEPSS 88.0%KEVCVE-2016-9079HIGHA use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild EPSS 87.6%KEVCVE-2020-0674HIGHA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripEPSS 86.9%KEVCVE-2025-49844CRITICALRedis Lua Use-After-Free may lead to remote code executionEPSS 86.8%CVE-2013-3893HIGHUse-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote aEPSS 85.9%KEVCVE-2014-0322HIGHUse-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involvingEPSS 85.2%KEVCVE-2023-29325HIGHWindows OLE Remote Code Execution VulnerabilityEPSS 84.4%CVE-2020-3992CRITICALOpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a EPSS 83.0%KEVCVE-2018-15982HIGHFlash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could EPSS 82.5%KEVCVE-2010-0806HIGHUse-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote atEPSS 82.2%KEV