Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
4,618 results · Clear filters · Feed
-
High 7.8
Photoshop Desktop | Use After Free (CWE-416)
Photoshop Desktop is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
-
High 7.5
In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger a double free and process abo…
-
High 8.8
Microsoft Office Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Autopilot Elevation of Privilege Vulnerability
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Trace Data Helper Elevation of Privilege Vulnerability
Use after free in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Win32k Elevation of Privilege Vulnerability
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Audio Service Elevation of Privilege Vulnerability
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Filter Manager Elevation of Privilege Vulnerability
Use after free in Windows Filter Manager allows an authorized attacker to elevate privileges locally.
-
High 8.1
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
-
High 8.1
Windows Internet Information Services Remote Code Execution Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows DNS Elevation of Privilege Vulnerability
Use after free in Windows DNS allows an authorized attacker to elevate privileges locally.
-
High 8.1
Windows Deployment Services Remote Code Execution Vulnerability
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
-
High 7.5
Windows Hyper-V Elevation of Privilege Vulnerability
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
-
High 8.1
Windows Modern Device Management (MDM) Remote Code Execution Vulnerability
Use after free in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Audio Service Elevation of Privilege Vulnerability
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Audio Service Elevation of Privilege Vulnerability
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Audio Service Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Audio Service Elevation of Privilege Vulnerability
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows NetBIOS Elevation of Privilege Vulnerability
Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Device Association Service Elevation of Privilege Vulnerability
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Device Association Service Elevation of Privilege Vulnerability
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability
Use after free in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability
Use after free in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Device Association Service Elevation of Privilege Vulnerability
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Smart Card Elevation of Privilege Vulnerability
Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Hyper-V Elevation of Privilege Vulnerability
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Backup Engine Elevation of Privilege Vulnerability
Use after free in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Broadcast DVR User Service Elevation of Privilege Vulnerability
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.