Weakness (CWE)
CWE-415: Double Free
The product calls free() twice on the same memory address.
How to prevent it (3 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
-
Implementation
Use a static analysis tool to find double free instances.
Source: MITRE CWE-415
522 results · Feed
-
High 8.1
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
-
Medium 6.0
Double free validation vulnerability in setPinPadImages in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows loc…
-
Medium 6.5
An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictCom…
-
High 7.8
Visual Studio Remote Code Execution Vulnerability
Visual Studio Remote Code Execution Vulnerability
-
Critical 9.3
Double free in Core
Memory corruption due to double free in core while initializing the encryption key.
-
Unscored —
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing wa…
-
High 8.0
TensorFlow has double free in Fractional(Max/Avg)Pool
TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops.fractional_avg_pool_v2` and `nn_ops.fractional_max_pool_v2` require the first and fourth elements of their parameter `pooling_ratio` to be equal to 1.0, as po…
-
High 7.8
In Confirmation of keystore_cli_v2.cpp, there is a possible way to corrupt memory due to a double free. This could lead…
-
Medium 5.3
GPAC av_parsers.c gf_av1_reset_state double free
A vulnerability has been found in GPAC 2.3-DEV-rev35-gbbca86917-master and classified as problematic. This vulnerability affects the function gf_av1_reset_state of the file media_tools/av_parsers.c. The manipulation leads to double free. It is possible to lau…
-
High 7.8
Windows Media Remote Code Execution Vulnerability
Windows Media Remote Code Execution Vulnerability
-
High 7.3
Double free in Video
Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.
-
High 7.2
Sudo before 1.9.13p2 has a double free in the per-command chroot feature.
-
Medium 4.7
In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registe…
-
High 8.6
ClamAV Double-free Vulnerability in the OLE2 File Parser
A vulnerability in the OLE2 file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device.The vulnerability is due to incorrect use of the r…
-
High 7.1
A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauthorized code or comm…
-
Critical 9.8
Double Free vulnerability in virtualsquare picoTCP v1.7.0 and picoTCP-NG v2.1 in modules/pico_fragments.c in function p…
-
High 7.5CVE-2022-4450 EPSS 29%
Double free after calling PEM_read_bio_ex
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to…
-
Unscored —
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed …
-
Critical 9.8
Bluetooth HCI Error Handling Double Free
Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.
-
Medium 6.7
Use-After-Free Issue in Display
Memory corruption in display due to double free while allocating frame buffer memory
-
High 7.5
The DUBAI module has a double free vulnerability. Successful exploitation of this vulnerability may affect system avail…
-
Critical 9.8
Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec us…
-
High 7.8
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, …
-
High 7.8
A double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount and umount simultaneo…
-
Medium 6.7
In audio, there is a possible memory corruption due to a logic error. This could lead to local escalation of privilege …
-
Medium 6.5
-
High 8.1
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it se…
-
High 7.5
A double-free vulnerability exists in the web interface /action/ipcamSetParamPost functionality of Abode Systems, Inc. …
-
High 8.4
Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobi…
-
High 7.8
Memory corruption due to double free issue in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, S…
-
High 7.5CVE-2019-5797 Public exploit
Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap …
-
High 7.8
Rizin Double Free in bobj.c when using qnx binary plugin
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to a double free in bobj.c:rz_bin_reloc_storage_free() when freeing relocations generated from qnx binary plugin. A user opening a malicious q…
-
Unscored —
There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1
-
Unscored —
A double free issue was discovered in radare2 in cmd_info.c:cmd_info(). Successful exploitation could lead to modificat…
-
High 8.1
Double free or Use after Free in Value class of Jsonxx
Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx use of the Value class may lead to memory corruption via a double free or via a use after free. The value class has a default assignment operator which may be …
-
High 7.0
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it may double-free some re…
-
High 7.5
A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification o…
-
Medium 6.8
HiCOS’ client-side citizen digital certificate - Double Free
HiCOS’ client-side citizen certificate component has a double free vulnerability. An unauthenticated physical attacker can exploit this vulnerability to corrupt memory and execute arbitrary code, manipulate system data or terminate service.
-
Medium 5.9
Double free of buffer during string decoding in ujson
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the …
-
High —
Arrow2 allows double free in `safe` code
The struct `Ffi_ArrowArray` implements `#derive(Clone)` that is inconsistent with its custom implementation of `Drop`, resulting in a double free when cloned. Cloning this struct in `safe` results in a segmentation fault, which is unsound. This derive was rem…