Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
517 results · Clear filters · Feed
-
Critical 9.8
drachtio-server 0.8.18 has a request-handler.cpp event_cb use-after-free for any request.
-
Critical 9.8
Nginx NJS v0.7.2 was discovered to contain a heap-use-after-free bug caused by illegal memory copy in the function njs_…
-
Critical 9.8
A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases. This issue may allow an attac…
-
Critical 9.8
The BT Hfp Client module has a Use-After-Free (UAF) vulnerability.Successful exploitation of this vulnerability may res…
-
Critical 9.8
SWFTools commit 772e55a was discovered to contain a heap-use-after-free via the function grow_unicode at /lib/ttf.c.
-
Critical 9.3
Use-After-Free in str_escape in mruby/mruby in mruby/mruby
Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
-
Critical 9.6
Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the rend…
KEV Nov 3, 2021 -
Critical 9.6
Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised t…
KEV Nov 3, 2021 -
Critical 9.6
Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary …
KEV Nov 3, 2021 -
Critical 9.8
Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-254…
-
Critical 9.8
Use After Free in Hermes
A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application us…
-
Critical 9.8
HTTP Protocol Stack Remote Code Execution Vulnerability
HTTP Protocol Stack Remote Code Execution Vulnerability
KEV Apr 6, 2022 -
Critical 9.8
A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory…
-
Critical 9.8
Fix a use-after-free bug in diesels Sqlite backend
An issue was discovered in the diesel crate before 1.4.6 for Rust. There is a use-after-free in the SQLite backend because the semantics of sqlite3_column_name are not followed.
-
Critical 9.8
Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 all…
-
Critical 9.8
Use after free in nano_arena
An issue was discovered in the nano_arena crate before 0.5.2 for Rust. There is an aliasing violation in split_at because two mutable references can exist for the same element, if Borrow<Idx> behaves in certain ways. This can have a resultant out-of-bounds wr…
-
Critical 9.8
Use-after-free in yottadb
An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free.
-
Critical 9.6CVE-2020-16017 Exploited
Use after free in CefSharp
Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
KEV Nov 3, 2021 -
Critical 9.8
Use after free and double free in bitvec
An issue was discovered in the bitvec crate before 0.17.4 for Rust. BitVec to BitBox conversion leads to a use-after-free or double free.
-
Critical 9.8
Data races in rusqlite
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via VTab / VTabCursor.
-
Critical 9.8
Use after free in rio
An issue was discovered in the rio crate through 2020-05-11 for Rust. A struct can be leaked, allowing attackers to obtain sensitive information, cause a use-after-free, or cause a data race.
-
Critical 9.1
Use after free in actix-utils
An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.
-
Critical 9.8
Use-after-free in actix-codec
An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. There is a use-after-free in Framed.
-
Critical 9.1
Use After Free in HashiCorp Nomad
HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6
-
Critical 9.8
OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650…
KEV Nov 3, 2021 -
Critical 9.8
An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base G…
-
Critical 9.8
Use after free in portaudio-rs
An issue was discovered in the portaudio-rs crate through 0.3.1 for Rust. There is a use-after-free with resultant arbitrary code execution because of a lack of unwind safety in stream_callback and stream_finished_callback.
-
Critical 9.8
An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object po…
-
Critical 9.8
An exploitable use-after-free vulnerability exists in the way LZW-compressed streams are processed in Aspose.PDF 19.2 f…
-
Critical 9.8
Use after free in image
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.
-
Critical 9.8
Use-after-free in chttp
An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion.
-
Critical 9.8
Use after free in openssl
An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing.
-
Critical 9.8
Use after free in libflate
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
-
Critical 9.8
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an una…
KEV Nov 3, 2021 -
Critical 9.8
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary c…
KEV Jan 28, 2022 -
Critical 9.0CVE-2013-0022 EPSS 17%
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a c…
-
Critical 9.0CVE-2012-4787 EPSS 18%
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code …