Skip to content
OpenAdvisories

Weakness (CWE)

CWE-416: Use After Free

Variant

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Choose a language that provides automatic memory management.

  2. Implementation

    When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

Source: MITRE CWE-416

All Critical High Medium Low Exploited only Public exploit

67 results · Clear filters · Feed

  • High 8.8
    CVE-2019-13720 Exploited Public exploit EPSS 49%

    Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap…

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu
    KEV May 23, 2022
  • High 7.5
    CVE-2019-1429 Exploited Public exploit EPSS 77%

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

    Microsoft Internet Explorer 11 Internet Explorer 10 Internet Explorer 9 Windows
    KEV Nov 3, 2021
  • High 7.8
    CVE-2019-2215 Exploited Public exploit EPSS 72%

    A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interact…

    linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu
    KEV Nov 3, 2021
  • Medium 6.5
    CVE-2019-5786 Exploited Public exploit EPSS 61%

    Use-After-Free in puppeteer

    Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine npm
    KEV May 23, 2022
  • Critical 9.8
    CVE-2019-0708 Exploited · Ransomware Public exploit EPSS 100%

    A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an una…

    Microsoft Windows Windows Server Windows
    KEV Nov 3, 2021
  • High 7.8
    CVE-2019-0211 Exploited Public exploit EPSS 65%

    In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileg…

    Apache Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
    KEV Nov 3, 2021
  • High 7.8
    CVE-2018-15982 Exploited · Ransomware Public exploit EPSS 90%

    Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successfu…

    flashplugin-nonfree Ubuntu
    KEV Feb 15, 2022
  • High 7.5
    CVE-2016-9079 Exploited Public exploit EPSS 87%

    A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been di…

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
    KEV Jun 22, 2023
  • High 7.8
    CVE-2018-4878 Exploited · Ransomware Public exploit EPSS 90%

    A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to…

    flashplugin-nonfree Ubuntu
    KEV Nov 3, 2021
  • High 7.8
    CVE-2017-0261 Exploited Public exploit EPSS 78%

    Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the softwa…

    Microsoft Microsoft Office
    KEV Mar 3, 2022
  • High 7.8
    CVE-2017-0263 Exploited Public exploit EPSS 10%

    The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201…

    Microsoft Microsoft Windows Windows
    KEV Feb 10, 2022
  • High 8.8
    CVE-2016-7855 Exploited Public exploit EPSS 25%

    Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Lin…

    flashplugin-nonfree Ubuntu
    KEV Mar 3, 2022
  • High 8.8
    CVE-2016-0984 Exploited Public exploit EPSS 55%

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and…

    flashplugin-nonfree Ubuntu
    KEV May 25, 2022
  • High 7.8
    CVE-2015-5122 Exploited Public exploit EPSS 87%

    Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Playe…

    flashplugin-nonfree Ubuntu
    KEV Apr 13, 2022
  • High 7.8
    CVE-2015-5119 Exploited Public exploit EPSS 99%

    Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13…

    flashplugin-nonfree Ubuntu
    KEV Mar 3, 2022
  • High 7.8
    CVE-2015-0313 Exploited Public exploit EPSS 95%

    Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows…

    flashplugin-nonfree Ubuntu
    KEV Apr 13, 2022
  • High 8.8
    CVE-2014-0322 Exploited Public exploit EPSS 85%

    Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code …

    KEV May 4, 2022
  • High 8.8
    CVE-2013-3897 Exploited Public exploit EPSS 77%

    Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 all…

    KEV Mar 3, 2022
  • High 8.8
    CVE-2013-3893 Exploited Public exploit EPSS 88%

    Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 throu…

    KEV Aug 12, 2025
  • High 8.8
    CVE-2013-1347 Exploited Public exploit EPSS 78%

    Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbi…

    KEV Mar 3, 2022
  • High 8.8
    CVE-2013-2551 Exploited · Ransomware Public exploit EPSS 74%

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary c…

    KEV Mar 28, 2022
  • High 8.8
    CVE-2012-4792 Exploited Public exploit EPSS 79%

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary co…

    KEV Jul 23, 2024
  • High 8.1
    CVE-2012-4969 Exploited Public exploit EPSS 80%

    Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 a…

    KEV Jun 8, 2022
  • High 8.1
    CVE-2010-3962 Exploited Public exploit EPSS 97%

    Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary co…

    KEV Oct 6, 2025
  • High 8.8
    CVE-2010-0806 Exploited Public exploit EPSS 82%

    Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, a…

    KEV May 20, 2026
  • High 8.8
    CVE-2010-0249 Exploited Public exploit EPSS 92%

    Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and …

    KEV May 20, 2026
  • High 7.8
    CVE-2009-4324 Exploited Public exploit EPSS 82%

    Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before…

    KEV Jun 8, 2022