Weakness (CWE)
CWE-415: Double Free
The product calls free() twice on the same memory address.
How to prevent it (3 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
-
Implementation
Use a static analysis tool to find double free instances.
Source: MITRE CWE-415
57 results · Clear filters · Feed
-
Critical 9.8
Microsoft DirectMusic Remote Code Execution Vulnerability
Double free in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows DNS Remote Code Execution Vulnerability
Double free in Windows DNS allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to rem…
-
Critical 9.8
Microsoft Office Outlook Remote Code Execution Vulnerability
Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft Failover Cluster Virtual Driver Remote Code Execution Vulnerability
Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.
-
Critical 9.6
DragonflyDB stream RDB deserialization double-free
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared …
-
Critical 9.8
Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for …
-
Critical 9.9
Double Free in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due…
-
Critical 9.8
A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS…
-
Critical 9.8
Windows Graphics Component Remote Code Execution Vulnerability
Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
smb: client: fix double-free in SMB2_close() replay
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails before the next send, cle…
-
Critical 9.8
nvmet-tcp: Fix potential UAF when ddgst mismatch
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-fina…
-
Critical 9.8
smb: client: fix query directory replay double-free
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_directory_init() fails before the next…
-
Critical 9.8
smb: client: fix query_info() replay double-free
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails before the next send, c…
-
Critical 9.8
smb: client: fix change notify replay double-free
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_notify_init() fails before the next send, clea…
-
Critical 9.8
smb: client: fix double-free in SMB2_ioctl() replay
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cle…
-
Critical 9.8
smb: client: fix double-free in SMB2_flush() replay
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fa…
-
Critical 9.8
scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce…
-
Critical 9.8
SASL double-free
The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.
-
Critical 9.8
libbabl 0.1.62 Broken Double Free Detection Memory Safety
libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. Attackers can call babl_free() twice on the same pointer without triggering detectio…
-
Critical 9.8
scsi: qla2xxx: Completely fix fcport double free
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release…
-
Critical 9.8
net/x25: Fix potential double free of skb
In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1 (error). This error propagates back through the call chai…
-
Critical 9.8
smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()
In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() smbd_send_batch_flush() already calls smbd_free_send_io(), so we should not call it again after smbd_post_s…
-
Critical 9.8
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
KEV Aug 18, 2026 -
Critical 9.8
nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a reference to the xprt otherwise both client cleanup and t…
-
Critical 9.8
NFSv4.2: Rework scratch handling for READ_PLUS (again)
In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: Rework scratch handling for READ_PLUS (again) I found that the read code might send multiple requests using the same nfs_pgio_header, but nfs4_proc_read_setup() is only called once. …
-
Critical 9.8
smb: client: fix double free of TCP_Server_Info::hostname
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double free of TCP_Server_Info::hostname When shutting down the server in cifs_put_tcp_session(), cifsd thread might be reconnecting to multiple DFS targets before it realize…
-
Critical 9.8
FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.
-
Critical 9.8
A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under speci…
-
Critical 9.8
net: vertexcom: mse102x: Fix possible double free of TX skb
In the Linux kernel, the following vulnerability has been resolved: net: vertexcom: mse102x: Fix possible double free of TX skb The scope of the TX skb is wider than just mse102x_tx_frame_spi(), so in case the TX skb room needs to be expanded, we should free …
-
Critical 9.8
OpenBSD NFS double-free vulnerability
In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.
-
Critical 9.8
Azure IoT Platform Device SDK Double Free Vulnerability
The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. When processing an incorrect `AMQP_VALUE` failed state, may cause a double free problem. This may cause a RCE. Update submodule with commit 2ca42b6e4e098af2d17e487814a91d05f6ae4987.
-
Critical 9.8
A double-free vulnerability exists in the BrainVision Header Parsing functionality of The Biosig Project libbiosig Mast…
-
Critical 9.8
A double-free vulnerability exists in the BrainVision ASCII Header Parsing functionality of The Biosig Project libbiosi…
-
Critical 9.3
Double free in Core
Memory corruption due to double free in core while initializing the encryption key.
-
Critical 9.8
Double Free vulnerability in virtualsquare picoTCP v1.7.0 and picoTCP-NG v2.1 in modules/pico_fragments.c in function p…
-
Critical 9.8
Bluetooth HCI Error Handling Double Free
Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.
-
Critical 9.8
Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec us…
-
Critical 9.1
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointe…
-
Critical 9.8
Double free in sys-info
An issue was discovered in the sys-info crate before 0.8.0 for Rust. sys_info::disk_info calls can trigger a double free.