Weakness (CWE)
CWE-415: Double Free
The product calls free() twice on the same memory address.
How to prevent it (3 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
-
Implementation
Use a static analysis tool to find double free instances.
Source: MITRE CWE-415
522 results · Feed
-
Critical 9.6
DragonflyDB stream RDB deserialization double-free
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared …
-
Medium 6.5
FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A maliciou…
-
Low 3.7
ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder
ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure condit…
-
Medium 5.9
FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure
FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry t…
-
High 8.5
Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFile
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an …
-
Medium 4.8
Xerial snappy-java 1.1.7.4 before 1.1.10.10 Double Release of Pooled Buffers in SnappyFramedInputStream
Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to tri…
-
Medium 5.4
Double free in OmniOS and SmartOS ipmgmtd allows local users to crash the daemon
A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees …
-
Critical 9.8
Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for …
-
Low 2.3
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces…
-
Medium 5.9
ImageMagick: Use-After-Free in RSVG decoder that is build without cairo support
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to f…
-
Medium 6.2
In apu, there is a possible application crash due to double free. This could lead to local denial of service with no ad…
-
High 7.8
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could …
-
Critical 9.9
Double Free in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due…
-
High 7.8
Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process.
-
High 8.8
Double Free in lwIP (lightweight IP)
lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.
-
Medium 6.9
Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation.
Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.1.0 before 7.3.1.6.
-
Medium 5.7
Double free of the USB host configuration descriptor when device enumeration fails
The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_configuration() (subsys/usb/host/usbh_device.c). On three failure paths — a failed full-length GET_DE…
-
High 8.6
Cisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service Vulnerability
A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vul…
-
Medium 5.5
A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27. An app …
-
Critical 9.8
A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS…
-
High 8.2
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
-
Medium 4.2
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2…
-
High 7.8
An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1…
-
High 7.0
NetBSD COMPAT_NETBSD32 Double Free / Use-After-Free via recvmsg() msg_iovlen
NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary o…
-
High 8.8
Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially ex…
-
Medium 4.2
An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar u…
-
High 7.8
Acrobat Reader | Double Free (CWE-415)
Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Print Spooler Components Elevation of Privilege Vulnerability
Double free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Display Enhancement Service Elevation of Privilege Vulnerability
Double free in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Hello Elevation of Privilege Vulnerability
Double free in Windows Hello allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows DHCP Server Remote Code Execution Vulnerability
Use after free in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network.
-
High 7.0
Windows Bluetooth Service Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
-
High 8.0
Microsoft Windows Search Component Elevation of Privilege Vulnerability
Double free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Graphics Component Remote Code Execution Vulnerability
Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
-
High 8.2
Windows Credential Guard Elevation of Privilege Vulnerability
Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability
Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability
Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.