Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
517 results · Clear filters · Feed
-
Critical 9.6
Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code insid…
-
Critical 9.6
Use after free in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially …
-
Critical 9.6
Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside…
-
Critical 9.6
Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the…
-
Critical 9.6
Use after free in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code i…
-
Critical 9.6
Use after free in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker who had compromi…
-
Critical 9.6CVE-2026-118306 Public exploit
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary cod…
-
Critical 9.6
Sandbox escape due to use-after-free in the Widget component
Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
Critical 9.6
Sandbox escape due to use-after-free in the Graphics component
Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
Critical 9.8
Invalid pointer in the JavaScript Engine: JIT component
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
Critical 9.8
Use-after-free in the Graphics component
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
Critical 9.6
Sandbox escape due to use-after-free in the Print Preview component
Sandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
Critical 9.6
Use-after-free in the DOM: HTML Parser component
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
Critical 9.1
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7…
-
Critical 9.2
RCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…
KEV Oct 26, 2026 -
Critical 9.2
RCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…
KEV Oct 26, 2026 -
Critical 9.6
Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary co…
-
Critical 9.6
Use after free in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code insi…
-
Critical 9.6
Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code insid…
-
Critical 9.1
FTP wildcard write callback mixup
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of …
-
Critical 9.8
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns, the parser writes each field into the caller's own scalar without taking a reference t…
-
Critical 9.9
MariaDB: Use-after-free with a large number of SYS_REFCURSOR's
MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large …
-
Critical 9.6
Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary cod…
-
Critical 9.6
Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially e…
-
Critical 9.6
Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code o…
-
Critical 9.6
Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code o…
-
Critical 9.6
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outsi…
-
Critical 9.8
Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft Windows Search Component Elevation of Privilege Vulnerability
Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.8
Microsoft QUIC Remote Code Execution Vulnerability
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows DHCP Server Remote Code Execution Vulnerability
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft Office PowerPoint Remote Code Execution Vulnerability
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft Failover Cluster Remote Code Execution Vulnerability
Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
-
Critical 9.8
Windows CCFFilter Driver Remote Code Execution Vulnerability
Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows iSCSI Remote Code Execution Vulnerability
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
-
Critical 9.6
Sandbox escape due to use-after-free in the Networking component
Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
-
Critical 9.6
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
-
Critical 9.8
Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for …