Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
517 results · Clear filters · Feed
-
Critical 9.6CVE-2024-4671 Exploited
Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the re…
KEV May 13, 2024 -
Critical 9.8
nvme-tcp: fix UAF when detecting digest errors
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix UAF when detecting digest errors We should also bail from the io_work loop when we set rd_enabled to true, so we don't attempt to read data from the socket when the TCP stream i…
-
Critical 9.1
Unified Automation UaGateway NodeManagerOpcUa Use-After-Free Remote Code Execution Vulnerability
Unified Automation UaGateway NodeManagerOpcUa Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unified Automation UaGateway. Authentication is required to exp…
-
Critical 9.8
A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. …
-
Critical 9.8
scsi: core: Fix a use-after-free
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix a use-after-free There are two .exit_cmd_priv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still avail…
-
Critical 9.8CVE-2024-21334 EPSS 20%
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
-
Critical 9.7
Invalid DATA_FRAG Submessage causes a bad-free error
eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7, an invalid DATA_FRAG Submessage causes a bad-free error, and …
-
Critical 9.3
Use-after-free vulnerability
VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process run…
-
Critical 9.3
Use-after-free vulnerability
VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process run…
-
Critical 9.8
Use After Free in WLAN Host Communication
Memory corruption while processing MBSSID beacon containing several subelement IE.
-
Critical 9.8
ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF issue in ksmbd_tcp_new_connection() The race is between the handling of a new TCP connection and its disconnection. It leads to UAF on `struct tcp_transport` in ksmbd_tcp_new_c…
-
Critical 9.1
Inappropriate pointer order of laser_scan_filter_.reset() and tf_listener_.reset() (amcl_node.cpp) in Open Robotics Rob…
-
Critical 9.8
In readLogs of StatsService.cpp, there is a possible memory corruption due to a use after free. This could lead to loca…
-
Critical 9.8
Jsish v3.5.0 (commit 42c694c) was discovered to contain a use-after-free via the SplitChar at ./src/jsiUtils.c.
-
Critical 9.8
Use after free in Mojo in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap c…
-
Critical 9.8
Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwr…
-
Critical 9.6
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Critical 9.8
A heap-use-after-free vulnerability was found in live555 version 2023.05.10 while handling the SETUP.
-
Critical 9.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 10, iOS 17 and iPa…
-
Critical 9.8
Lotos WebServer through 0.1.1 (commit 3eb36cc) has a use-after-free in buffer_avail() at buffer.h via a long URI, becau…
-
Critical 9.6
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Critical 9.8
PJSIP has use-after-free vulnerability in SRTP media transport
PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Curren…
-
Critical 9.8
During process shutdown, it was possible that an `ImageBitmap` was created that would later be used after being freed f…
-
Critical 9.8
A hashtable in the Ion Engine could have been mutated while there was a live interior reference, leading to a potential…
-
Critical 9.8
If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointe…
-
Critical 9.8
A use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1. A specially cr…
-
Critical 9.6
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Critical 10.0
Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory aft…
-
Critical 10.0
In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.
-
Critical 9.8
A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0. NOTE: the vendor a…
-
Critical 9.8
A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prio…
-
Critical 9.8
A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause a…
-
Critical 9.8
In OnWakelockReleased of attribution_processor.cc, there is a use after free that could lead to remote code execution w…
-
Critical 9.8
HTTP Protocol Stack Remote Code Execution Vulnerability
HTTP Protocol Stack Remote Code Execution Vulnerability
-
Critical 9.8
An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() func…
-
Critical 9.8CVE-2022-47939 EPSS 49%
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c has a use-afte…
-
Critical 9.8
Session history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affe…
-
Critical 9.8
A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Fire…
-
Critical 9.8
If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while refer…
-
Critical 9.6CVE-2022-26486 Exploited
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We hav…
KEV Mar 7, 2022