Skip to content
OpenAdvisories

Weakness (CWE)

CWE-416: Use After Free

Variant

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Choose a language that provides automatic memory management.

  2. Implementation

    When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

Source: MITRE CWE-416

All Critical High Medium Low Exploited only Public exploit

205 results · Clear filters · Feed

  • High 7.8
    CVE-2021-34486 Exploited Public exploit

    Windows Event Tracing Elevation of Privilege Vulnerability

    Windows Event Tracing Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Mar 28, 2022
  • Critical 9.8
    CVE-2021-31166 Exploited Public exploit EPSS 100%

    HTTP Protocol Stack Remote Code Execution Vulnerability

    HTTP Protocol Stack Remote Code Execution Vulnerability

    Microsoft Windows 10 Version 20H2 Windows Server version 20H2 Windows 10 Version 2004 Windows
    KEV Apr 6, 2022
  • High 8.8
    CVE-2021-28663 Exploited Public exploit EPSS 12%

    The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are …

    KEV Nov 3, 2021
  • High 8.8
    CVE-2021-21193 Exploited Public exploit

    Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap co…

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
    KEV Nov 3, 2021
  • High 8.8
    CVE-2021-26411 Exploited · Ransomware Public exploit EPSS 82%

    Internet Explorer Memory Corruption Vulnerability

    Internet Explorer Memory Corruption Vulnerability

    Microsoft Internet Explorer 11 Internet Explorer 9 Microsoft Edge (EdgeHTML-based) Browsers
    KEV Nov 3, 2021
  • Unscored —
    CVE-2020-25632 Public exploit

    A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as …

    grub2 grub2-signed grub2-unsigned grub2 Debian Ubuntu Azure Linux Alpine
  • High 7.8
    CVE-2021-3347 Public exploit

    An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • Unscored —
    CVE-2020-27786 Public exploit

    A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissio…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • High 7.8
    CVE-2020-14381 Public exploit

    A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • Critical 9.8
    CVE-2020-3992 Exploited · Ransomware Public exploit EPSS 83%

    OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650…

    Virtualization
    KEV Nov 3, 2021
  • High 7.8
    CVE-2020-9715 Exploited Public exploit EPSS 33%

    Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.…

    Adobe Adobe Acrobat and Reader
    KEV Apr 13, 2026
  • High 7.8
    CVE-2020-1712 Public exploit

    A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are…

    [UNKNOWN] systemd systemd systemd Debian Ubuntu
  • High 7.5
    CVE-2020-0674 Exploited Public exploit EPSS 87%

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

    Microsoft Internet Explorer 11 Internet Explorer 10 Internet Explorer 9 Windows
    KEV Nov 3, 2021
  • High 7.8
    CVE-2019-8605 Exploited Public exploit EPSS 18%

    A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.…

    Apple macOS watchOS tvOS macOS iOS
    KEV Jun 27, 2022
  • Critical 9.8
    CVE-2019-5096 Public exploit EPSS 67%

    An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base G…

  • High 8.8
    CVE-2019-13720 Exploited Public exploit EPSS 49%

    Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap…

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu
    KEV May 23, 2022
  • High 7.5
    CVE-2019-1429 Exploited Public exploit EPSS 77%

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

    Microsoft Internet Explorer 11 Internet Explorer 10 Internet Explorer 9 Windows
    KEV Nov 3, 2021
  • High 7.8
    CVE-2019-2215 Exploited Public exploit EPSS 72%

    A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interact…

    linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu
    KEV Nov 3, 2021
  • Medium 6.5
    CVE-2019-5786 Exploited Public exploit EPSS 61%

    Use-After-Free in puppeteer

    Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine npm
    KEV May 23, 2022
  • Critical 9.8
    CVE-2019-0708 Exploited · Ransomware Public exploit EPSS 100%

    A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an una…

    Microsoft Windows Windows Server Windows
    KEV Nov 3, 2021
  • High 7.8
    CVE-2019-0211 Exploited Public exploit EPSS 65%

    In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileg…

    Apache Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
    KEV Nov 3, 2021
  • High 7.8
    CVE-2018-15982 Exploited · Ransomware Public exploit EPSS 90%

    Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successfu…

    flashplugin-nonfree Ubuntu
    KEV Feb 15, 2022
  • High 7.5
    CVE-2016-9079 Exploited Public exploit EPSS 87%

    A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been di…

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
    KEV Jun 22, 2023
  • Unscored —
    CVE-2018-9958 Public exploit EPSS 62%

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2018-9951 Public exploit

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.…

    Foxit Foxit Reader
  • High 7.8
    CVE-2018-4878 Exploited · Ransomware Public exploit EPSS 90%

    A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to…

    flashplugin-nonfree Ubuntu
    KEV Nov 3, 2021
  • High 7.8
    CVE-2017-0261 Exploited Public exploit EPSS 78%

    Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the softwa…

    Microsoft Microsoft Office
    KEV Mar 3, 2022
  • High 7.8
    CVE-2017-0263 Exploited Public exploit EPSS 10%

    The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201…

    Microsoft Microsoft Windows Windows
    KEV Feb 10, 2022
  • High 8.8
    CVE-2016-7855 Exploited Public exploit EPSS 25%

    Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Lin…

    flashplugin-nonfree Ubuntu
    KEV Mar 3, 2022
  • High 8.8
    CVE-2016-0984 Exploited Public exploit EPSS 55%

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and…

    flashplugin-nonfree Ubuntu
    KEV May 25, 2022
  • High 7.8
    CVE-2015-5122 Exploited Public exploit EPSS 87%

    Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Playe…

    flashplugin-nonfree Ubuntu
    KEV Apr 13, 2022
  • High 7.8
    CVE-2015-5119 Exploited Public exploit EPSS 99%

    Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13…

    flashplugin-nonfree Ubuntu
    KEV Mar 3, 2022
  • High 7.8
    CVE-2015-0313 Exploited Public exploit EPSS 95%

    Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows…

    flashplugin-nonfree Ubuntu
    KEV Apr 13, 2022
  • High 8.8
    CVE-2014-0322 Exploited Public exploit EPSS 85%

    Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code …

    KEV May 4, 2022
  • High 8.8
    CVE-2013-3897 Exploited Public exploit EPSS 77%

    Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 all…

    KEV Mar 3, 2022
  • High 8.8
    CVE-2013-3893 Exploited Public exploit EPSS 88%

    Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 throu…

    KEV Aug 12, 2025
  • High 8.8
    CVE-2013-1347 Exploited Public exploit EPSS 78%

    Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbi…

    KEV Mar 3, 2022
  • High 8.8
    CVE-2013-2551 Exploited · Ransomware Public exploit EPSS 74%

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary c…

    KEV Mar 28, 2022
  • High 8.8
    CVE-2012-4792 Exploited Public exploit EPSS 79%

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary co…

    KEV Jul 23, 2024
  • High 8.1
    CVE-2012-4969 Exploited Public exploit EPSS 80%

    Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 a…

    KEV Jun 8, 2022