Skip to content
OpenAdvisories

Weakness (CWE)

CWE-416: Use After Free

Variant

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Choose a language that provides automatic memory management.

  2. Implementation

    When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

Source: MITRE CWE-416

All Critical High Medium Low Exploited only Public exploit

4,663 results · Clear filters · Feed

  • High 7.8
    CVE-2021-31450

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.3…

    Foxit Reader
  • High 7.8
    CVE-2021-31441

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.3…

    Foxit Reader
  • High 8.4
    CVE-2021-1905 Exploited

    Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon …

    Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wear
    KEV Nov 3, 2021
  • High 7.2
    CVE-2021-21417

    Use after free in fluidsynth

    fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file.

    FluidSynth fluidsynth fluidsynth fluidsynth Debian Ubuntu Alpine
  • High 8.8
    CVE-2021-21206 Exploited

    Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap c…

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
    KEV Nov 3, 2021
  • High 7.5
    CVE-2021-0270

    Junos OS: PTX Series, QFX10K Series: A PTX/QFX FPC may restart unexpectedly with the "inline-Jflow" feature enabled on a large-scale deployment

    On PTX Series and QFX10k Series devices with the "inline-jflow" feature enabled, a use after free weakness in the Packet Forwarding Engine (PFE) microkernel architecture of Juniper Networks Junos OS may allow an attacker to cause a Denial of Service (DoS) con…

    Juniper Networks Junos OS Network devices
  • High 7.3
    CVE-2021-29935

    Use after free in Rocket

    An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.

    rocket crates.io
  • High 7.8
    CVE-2021-27268

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1…

    Foxit PhantomPDF
  • High 7.8
    CVE-2021-27267

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1…

    Foxit PhantomPDF
  • High 7.8
    CVE-2021-29096

    ArcGIS general raster security update: use-after-free

    A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context o…

    Esri ArcReader ArcGIS Desktop ArcGIS Desktop Background Geoprocessing
  • High 8.8
    CVE-2021-21193 Exploited Public exploit

    Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap co…

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
    KEV Nov 3, 2021
  • High 8.8
    CVE-2021-26411 Exploited · Ransomware Public exploit EPSS 82%

    Internet Explorer Memory Corruption Vulnerability

    Internet Explorer Memory Corruption Vulnerability

    Microsoft Internet Explorer 11 Internet Explorer 9 Microsoft Edge (EdgeHTML-based) Browsers
    KEV Nov 3, 2021
  • High 8.8
    CVE-2020-13558

    A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A s…

    qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Browsers Debian Ubuntu Alpine
  • High 7.8
    CVE-2021-21040

    Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution

    Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary …

    Adobe Acrobat Reader
  • High 8.8
    CVE-2021-21021

    Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution

    Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary …

    Adobe Acrobat Reader
  • High 7.8
    CVE-2021-21039

    Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution

    Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary …

    Adobe Acrobat Reader
  • High 8.8
    CVE-2021-21033

    Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution

    Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary …

    Adobe Acrobat Reader
  • High 7.8
    CVE-2021-21041

    Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution

    Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary …

    Adobe Acrobat Reader
  • High 8.8
    CVE-2021-21035

    Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution

    Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary …

    Adobe Acrobat Reader
  • High 8.8
    CVE-2021-21028

    Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution

    Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary …

    Adobe Acrobat Reader com.adobe.acs:acs-aem-commons Maven
  • High 8.0
    CVE-2020-13548 EPSS 66%

    In Foxit Reader 10.1.0.37527, a specially crafted PDF document can trigger reuse of previously free memory which can le…

  • High 7.8
    CVE-2021-3347 Public exploit

    An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • High 8.8
    CVE-2020-6572 Exploited EPSS 11%

    Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via …

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu
    KEV Jan 10, 2022
  • High 7.5
    CVE-2020-35901

    Use-after-free in actix-http

    An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream.

    actix-http crates.io
  • High 7.8
    CVE-2020-35906

    futures_task::waker may cause a use-after-free if used on a type that isn't 'static

    An issue was discovered in the futures-task crate before 0.3.6 for Rust. futures_task::waker may cause a use-after-free in a non-static type situation.

    futures-task rust-futures-task Ubuntu crates.io
  • High 7.5
    CVE-2020-13570

    A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.0.37527. A …

  • High 8.8
    CVE-2020-13560

    A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.375…

  • High 8.8
    CVE-2020-13557 EPSS 70%

    A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.375…

  • High 8.8
    CVE-2020-13531

    A use-after-free vulnerability exists in a way Pixar OpenUSD 20.08 processes reference paths textual USD files. A speci…

  • High 7.8
    CVE-2020-14381 Public exploit

    A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • High 7.8
    CVE-2020-24430 EPSS 19%

    Acrobat Pro DC Use-After-Free vulnerability Could Lead to Arbitrary Code Execution

    Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability when handling malicious JavaScript. This vulnerability could result in arbitrary code executi…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2020-24437 EPSS 47%

    Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Arbitrary Code Execution

    Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in th…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2020-17417 EPSS 10%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.1.3…

    Foxit Reader
  • High 7.8
    CVE-2020-17410 EPSS 10%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0…

    Foxit PhantomPDF
  • High 8.8
    CVE-2020-6115

    An exploitable vulnerability exists in the cross-reference table repairing functionality of Nitro Software, Inc.’s Nitr…

  • High 7.8
    CVE-2020-14363

    An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged att…

    The X11 Project libX11 libx11 libx11 Debian Ubuntu Alpine
  • High 7.8
    CVE-2020-9715 Exploited Public exploit EPSS 33%

    Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.…

    Adobe Adobe Acrobat and Reader
    KEV Apr 13, 2026
  • High 7.8
    CVE-2020-7827

    DaviewIndy Use-After-Free Vulnerability

    DaviewIndy 8.98.7 and earlier version contain Use-After-Free vulnerability, triggered when the user opens a malformed specific file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.

    HumanTalk Co,Ltd DavieIndy
  • High 7.8
    CVE-2020-9566

    Adobe Bridge versions 10.0.1 and earlier version have an use after free vulnerability. Successful exploitation could le…

    Adobe Adobe Bridge
  • High 7.8
    CVE-2020-9567

    Adobe Bridge versions 10.0.1 and earlier version have an use after free vulnerability. Successful exploitation could le…

    Adobe Adobe Bridge