Weakness (CWE)
CWE-415: Double Free
The product calls free() twice on the same memory address.
How to prevent it (3 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
-
Implementation
Use a static analysis tool to find double free instances.
Source: MITRE CWE-415
112 results · Clear filters · Feed
-
Medium 5.9
Double Free in µD3TN
Double Free in µD3TN BPv6 Fragmenter Block Duplication allows Unauthenticated Remote Attacker to Cause DoS on Allocation Failure
-
Medium 6.7
In usb, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a…
-
Medium 6.7
In afe, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a…
-
Medium 6.9
Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages
Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an…
-
Medium 5.5
libyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data
libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered p…
-
Medium 5.2
Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path
The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In data_ready_work_handler() (drivers/sensor/broadcom/afbr_s50/afbr_s50.c), a non-STATUS_OK return from Argus_EvaluateData() calls handle…
-
Medium 5.5CVE-2026-86962 Public exploit
A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS…
-
Medium 4.3
Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. …
-
Medium 5.3
libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handle
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale …
-
Medium 6.5
Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string …
-
Medium 6.5
FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A maliciou…
-
Medium 5.9
FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure
FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry t…
-
Medium 4.8
Xerial snappy-java 1.1.7.4 before 1.1.10.10 Double Release of Pooled Buffers in SnappyFramedInputStream
Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to tri…
-
Medium 5.4
Double free in OmniOS and SmartOS ipmgmtd allows local users to crash the daemon
A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees …
-
Medium 5.9
ImageMagick: Use-After-Free in RSVG decoder that is build without cairo support
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to f…
-
Medium 6.2
In apu, there is a possible application crash due to double free. This could lead to local denial of service with no ad…
-
Medium 6.9
Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation.
Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.1.0 before 7.3.1.6.
-
Medium 5.7
Double free of the USB host configuration descriptor when device enumeration fails
The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_configuration() (subsys/usb/host/usbh_device.c). On three failure paths — a failed full-length GET_DE…
-
Medium 5.5
A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27. An app …
-
Medium 4.2
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2…
-
Medium 4.2
An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar u…
-
Medium 6.4
Windows Failover Cluster Elevation of Privilege Vulnerability
Double free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally.
-
Medium 6.8
A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticate…
-
Medium 6.7
In camera middleware, there is a possible escalation of privilege due to double free. This could lead to local escalati…
-
Medium 5.9
Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client
A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be r…
-
Medium 5.9
MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination
An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can inte…
-
Medium 5.5
GPU DDK - Silent High-Order CMA Memory Leak & Double Free in `_FreeOSPages_Fast`
Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption. Scenario caused by memory free paths not maintaining state data of upgraded higher order allocations. This could…
-
Medium 5.9
389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control
A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. Operation teardown then frees the same poi…
-
Medium 5.9
Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths
The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, violated the bt_hci_driver_api buffer-ownership contract. That contract requires the driver to consume (unref) the transmit net_buf only on success; on…
-
Medium 5.9
Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb)
The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drivers/bluetooth/hci/hci_bflb.c, violates the bt_hci_driver_api.send() buffer-ownership contract. That contract (documented at include/zephyr/drivers/blu…
-
Medium 4.0
Double Free in H5D__chunk_copy() in HDF5 via a Crafted Chunk-Index Size Field
A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.
-
Medium 6.2
YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack
YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anch…
-
Medium 6.3
Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free
A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation causes double free. The a…
-
Medium 6.1
Gimp: gimp: double-free in read_layer_block()
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of servic…
-
Medium 6.4
Non-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unref
The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- the per-header buf->ref and the per-data-block ref_count at the start of each variable/heap data allocation -- with plain non-atomic C operators (buf->ref++, if (--buf-…
-
Medium 6.5
A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2,…
-
Medium 4.3
Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service
A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the clie…
-
Medium 6.8
ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compou…
-
Medium 5.8
unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race
unbounded_spsc is an "unbounded" extension of bounded_spsc_queue. In versions 0.2.0 and prior, sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race. At time of publication, there are no publicly available patches.
-
Medium 5.0
Double-free When Checking OCSP Stapled Response
Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client's certificate verification path. Impact summary: Successful exploitation allows an at…