Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
517 results · Clear filters · Feed
-
Critical 9.6
Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging socia…
-
Critical 9.6
Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outs…
-
Critical 9.6
Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outs…
-
Critical 9.6
Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary…
-
Critical 9.6
Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbi…
-
Critical 9.8
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote e…
-
Critical 9.3
Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code w…
-
Critical 9.6
Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code …
-
Critical 9.6
Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to execute arbitr…
-
Critical 9.6
Use after free in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social enginee…
-
Critical 9.6
Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute…
-
Critical 9.6
Use after free in Aura in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitra…
-
Critical 9.6
Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arb…
-
Critical 9.6
Use after free in Browser in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker leveraging so…
-
Critical 9.6
Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering …
-
Critical 9.6
Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbit…
-
Critical 9.6
Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arb…
-
Critical 9.6
Use after free in Device in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially exe…
-
Critical 9.6
Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineer…
-
Critical 9.6
Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbit…
-
Critical 9.6
Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbit…
-
Critical 9.6
Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbi…
-
Critical 9.6
Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code out…
-
Critical 9.6
Use after free in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbi…
-
Critical 9.8
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft Failover Cluster Remote Code Execution Vulnerability
Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Message Queuing Remote Code Execution Vulnerability
Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
Use after free in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows DHCP Server Remote Code Execution Vulnerability
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows DNS Server Remote Code Execution Vulnerability
Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Remote Desktop Services Remote Code Execution Vulnerability
Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
-
Critical 9.1
HTTP/2 server push UAF
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
-
Critical 9.6
Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code …
-
Critical 9.6
Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbit…
-
Critical 9.0
Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code out…
-
Critical 9.6
Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbi…
-
Critical 9.6
Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker lev…
-
Critical 9.6
Sandbox escape due to use-after-free in the DOM: Security component
Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.